Analysis
- max time kernel
143s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
20/08/2024, 18:11
General
- Target b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe
- Size 699KB
- Sample240820-wstbrswejd
- SHA256 19492b5df68b96dd4dd552f1a4735f795fa8bedef47ac95f1336d9731ec5edd2
Malware Config
Extracted
-
xloader
-
2.5
-
scb0
-
introlly.com
-
slowtravelco.com
-
sasanos.com
-
3424soldbastrophwy.com
-
isabelaefernando.net
-
0754fm.com
-
meta-bot.xyz
-
778tt8.com
-
krallechols.quest
-
lipagent.com
-
dermaqueeniran.com
-
psychoterapeuta-wroclaw.com
-
marmorariapiramide.online
-
luxonealbery.com
-
floridawp.com
-
nebobuild.com
-
facillitiespro-sweep.com
-
wwgzj.com
-
puffsmoke.online
-
cryptofuelcars.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b04b0416c7a562416e58c07fb38699a7_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3540-11-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3540-14-0x00000000011A0000-0x00000000014EA000-memory.dmp
memory/4720-6-0x0000000005080000-0x000000000511C000-memory.dmp
memory/4720-3-0x0000000004E40000-0x0000000004ED2000-memory.dmp
memory/4720-4-0x0000000004DF0000-0x0000000004DFA000-memory.dmp
memory/4720-5-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/4720-0-0x00000000750DE000-0x00000000750DF000-memory.dmp
memory/4720-7-0x0000000004E30000-0x0000000004E42000-memory.dmp
memory/4720-8-0x00000000750DE000-0x00000000750DF000-memory.dmp
memory/4720-9-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/4720-10-0x0000000006810000-0x0000000006864000-memory.dmp
memory/4720-2-0x0000000005350000-0x00000000058F4000-memory.dmp
memory/4720-13-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/4720-1-0x0000000000370000-0x0000000000424000-memory.dmp