xloader | 5852e0b1479d914e16a2f1cf21d61ff4e1f3d35b6fa5dbcf0055cfc2c9a89936

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-08-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe
Size

256KB
MD5

9b8f96489ef491a4378ae2552ee9950f
SHA1

276b5857cd4b0b4289660efa6751821df93f374f
SHA256

5852e0b1479d914e16a2f1cf21d61ff4e1f3d35b6fa5dbcf0055cfc2c9a89936
SHA512

7bd616157ae2c8021434937438fbcff60c139aafbb31f8c9b431925ecc2543af16216236557ba32360c784a6a65ef86f1e59b5a2fba47602035b9569731eac9a
SSDEEP

6144:F8LxBsMM0ev4yAs/lCDDtCupqxt9smUMHoeE/ZRPCb3tk:/lQuq14xghR4dk

Score

10^/10

xloader ycnd discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ycnd

Decoy

com-weekly.email

mfcon.net

bepcfinanceira.com

fattynoodlefitness.com

1pavij.cloud

sddn36.xyz

bestmoviequote.com

pntex.xyz

epicdefence.com

severiendepruis.online

spatialarray.com

aa6588.com

delucagiuseppe.com

xn--lu5bu5b0wddtl.com

staffingbackgrounds.com

miragetorrent.com

zdofmsk.online

charmsandfables.com

pifsdefistudio.com

paisacollection.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2352-9-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

pid	Process
3048	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3048 set thread context of 2352	3048	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

pid	Process
2352	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3048 wrote to memory of 2352	3048	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2352	3048	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2352	3048	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2352	3048	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2352	3048	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2352	3048	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2352	3048	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdD22E.tmp\vksn.dll

Filesize
20KB

MD5
e34c52bba24db2908916801f8e39b7a7

SHA1
d58cf73e0993109a2cd0a07c980682337186385b

SHA256
e203779a905288614ca814693eaf5841c2213ca6c9f2e6d127accbaf69e84c32

SHA512
0e5abbc376c252936fb9ae149d000aa15b971d3e49b8f224a3789750f9ccbd1d399ceec28318e4e34d00577ed4140baba6fbdb8c57f33f6fc43131bd2c036436

Download Submit
memory/2352-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3048-7-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/3048-10-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download