xloader | ad855c55e13ef5274a20805a3836b508c29cae12d0a2de2807aed08ed4090ddd

General

Target

c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe
Size

295KB
MD5

c8b318ed16d918943d2fa406840738c4
SHA1

a61153eae1a7aee1ee57128f3f7284ed6592af30
SHA256

ad855c55e13ef5274a20805a3836b508c29cae12d0a2de2807aed08ed4090ddd
SHA512

dbe2be95fc13c607e81093ed4da10418a8d3b761a2c38179f3a5045fd2509d3c0e3b0ee589a55f3c8691d99ab2e48bc9575b60d1a26b391fd4b6e6a59e1acc31
SSDEEP

6144:Gx/MLiVFI8E2SO1l/oZzHACNIrl9F6G+WIEarFVr:61o8E2Scl4HMp9FzI9fr

Score

10^/10

xloader r8pp discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

r8pp

Decoy

ishqjewelery.com

gfshanta.xyz

koolbreath.info

ukarchitecturalglazing.com

safwewds.com

padshows.net

shynebrightrentals.com

gemstonewiz.net

anteplizade.com

garbagetrucksrule.com

mybeautifulplanetblog.com

princessi.com

beautyld.com

arrival-globe.com

peach-sandbox.finance

epsb2b.com

tomp3d.net

bostonm.info

inflectionadvice.com

servicesguidedata.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/572-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Loads dropped DLL 2 IoCs

Processes:

c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe

pid	Process
2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe
2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2544 set thread context of 572	2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exec8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe

pid	Process
2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe
2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe
2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe
2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe
572	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe

pid	Process
2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2544 wrote to memory of 572	2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe	29
PID 2544 wrote to memory of 572	2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe	29
PID 2544 wrote to memory of 572	2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe	29
PID 2544 wrote to memory of 572	2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe	29
PID 2544 wrote to memory of 572	2544	c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c8b318ed16d918943d2fa406840738c4_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\d4xd.dll

Filesize
10KB

MD5
cc531db3ae7d662a2054f787c038762d

SHA1
5f87a3836db1886d07a0d480cb7b72d89672d36a

SHA256
9ca23ee06a0d89ba6a9b18bce1e3a7d94bf987df10234d2890d5e860d8a2790a

SHA512
e01ddaadf0efb4f4ec556e9882d02a51666a5cef118ec617f42c75bf80abb8566a6393fd6899fc76c9537eb66ef2c081fb5eec13f13bdc2a2ee74bd1b34d5632

Download Submit
\Users\Admin\AppData\Local\Temp\nsuE0CF.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/572-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2544-10-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2544-13-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads