Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
- submitted
01/08/2024, 16:01
General
- Target 81206806ca9526a7e21cc35a56e0c706_JaffaCakes118.exe
- Size 719KB
- Sample240801-tgps4aybpm
- SHA256 123a1e9fbf8447659da30d82c6c6c2b909f5b57ca8dcf83db930a4929e9ce4d7
Malware Config
Extracted
-
xloader
-
2.3
-
uszn
-
animegriptape.com
-
pcpnetworks.com
-
putupmybabyforadoption.com
-
xn--jvrr98g37n88d.com
-
fertinvitro.doctor
-
undonethread.com
-
avoleague.com
-
sissysundays.com
-
guilhermeoliveiro.site
-
catholicon-bespeckle.info
-
mardesuenosfundacion.com
-
songkhoe24.site
-
shoecityindia.com
-
smallbathroomdecor.info
-
tskusa.com
-
prairiespringsllc.com
-
kegncoffee.com
-
clicklounge.xyz
-
catholicendoflifeplanning.com
-
steelobzee.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81206806ca9526a7e21cc35a56e0c706_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81206806ca9526a7e21cc35a56e0c706_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\81206806ca9526a7e21cc35a56e0c706_JaffaCakes118.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/540-6-0x0000000008390000-0x000000000842C000-memory.dmp
memory/540-13-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/540-2-0x0000000005F70000-0x0000000006514000-memory.dmp
memory/540-3-0x0000000005A60000-0x0000000005AF2000-memory.dmp
memory/540-5-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/540-4-0x0000000005A30000-0x0000000005A3A000-memory.dmp
memory/540-8-0x0000000074E5E000-0x0000000074E5F000-memory.dmp
memory/540-0-0x0000000074E5E000-0x0000000074E5F000-memory.dmp
memory/540-1-0x0000000000FA0000-0x000000000105A000-memory.dmp
memory/540-9-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/540-10-0x0000000008300000-0x0000000008388000-memory.dmp
memory/540-7-0x0000000005ED0000-0x0000000005ED8000-memory.dmp
memory/1356-11-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1356-14-0x0000000001040000-0x000000000138A000-memory.dmp