xloader | 19492b5df68b96dd4dd552f1a4735f795fa8bedef47ac95f1336d9731ec5edd2

Analysis

max time kernel
143s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe
Size

699KB
MD5

b04b0416c7a562416e58c07fb38699a7
SHA1

e0737cd598cd24a694632f81bb274d1e8792840a
SHA256

19492b5df68b96dd4dd552f1a4735f795fa8bedef47ac95f1336d9731ec5edd2
SHA512

ab541f799016fcf96e89d5e64232cbc94544e777875b8d8c33a68dc058467dfd53da09b11e911a0d654e0109d4e5e353dfaaaec1753b35f6dad8a8d8be22fd02
SSDEEP

6144:0leWOQ+3HwOExxWFVBHtfsrIL7po8wutYF7Ke2ubf3XJvf9NGJUa/tnhn4122Irm:moXz68Le8wuOF7KeL3XJv10U4l4l

Score

10^/10

xloader scb0 discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

scb0

Decoy

introlly.com

slowtravelco.com

sasanos.com

3424soldbastrophwy.com

isabelaefernando.net

0754fm.com

meta-bot.xyz

778tt8.com

krallechols.quest

lipagent.com

dermaqueeniran.com

psychoterapeuta-wroclaw.com

marmorariapiramide.online

luxonealbery.com

floridawp.com

nebobuild.com

facillitiespro-sweep.com

wwgzj.com

puffsmoke.online

cryptofuelcars.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3540-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4720 set thread context of 3540	4720	b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe	98

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3540	b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe
3540	b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3540	4720	b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe	98
PID 4720 wrote to memory of 3540	4720	b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe	98
PID 4720 wrote to memory of 3540	4720	b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe	98
PID 4720 wrote to memory of 3540	4720	b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe	98
PID 4720 wrote to memory of 3540	4720	b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe	98
PID 4720 wrote to memory of 3540	4720	b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3540-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3540-14-0x00000000011A0000-0x00000000014EA000-memory.dmp

Filesize
3.3MB

Download
memory/4720-6-0x0000000005080000-0x000000000511C000-memory.dmp

Filesize
624KB

Download
memory/4720-3-0x0000000004E40000-0x0000000004ED2000-memory.dmp

Filesize
584KB

Download
memory/4720-4-0x0000000004DF0000-0x0000000004DFA000-memory.dmp

Filesize
40KB

Download
memory/4720-5-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/4720-0-0x00000000750DE000-0x00000000750DF000-memory.dmp

Filesize
4KB

Download
memory/4720-7-0x0000000004E30000-0x0000000004E42000-memory.dmp

Filesize
72KB

Download
memory/4720-8-0x00000000750DE000-0x00000000750DF000-memory.dmp

Filesize
4KB

Download
memory/4720-9-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/4720-10-0x0000000006810000-0x0000000006864000-memory.dmp

Filesize
336KB

Download
memory/4720-2-0x0000000005350000-0x00000000058F4000-memory.dmp

Filesize
5.6MB

Download
memory/4720-13-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/4720-1-0x0000000000370000-0x0000000000424000-memory.dmp

Filesize
720KB

Download