Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
15/09/2024, 14:19
General
- Target e2aed402a91f870f2d9caf0da11b8efe_JaffaCakes118.exe
- Size 501KB
- Sample240915-rnaxeaxcpb
- SHA256 81868cc802535d46ef3098d7eab8cd3d40ca6e2770e6907a64927506ca43660b
Malware Config
Extracted
-
xloader
-
2.1
-
p980
-
iwantgoddessevelyn.com
-
attorneysiraq.com
-
stfairytale-gakuin.site
-
mybazaartrip.com
-
alexjrtransport.com
-
present-sense.store
-
bigbucks4you.com
-
westernwings.info
-
qrs4u.com
-
knightsbridgehouse.com
-
fanamfoods.com
-
ediblesareincredible.com
-
revinedbypao.com
-
psychsolutionsofdurham.com
-
xn--mykyr-kra.com
-
sweettreatsepiceats.com
-
quarnetta.com
-
femaletopic.com
-
rockstoneofblue.com
-
btbaidu.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e2aed402a91f870f2d9caf0da11b8efe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2aed402a91f870f2d9caf0da11b8efe_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1132-24-0x0000000002970000-0x0000000002A00000-memory.dmp
memory/1132-25-0x0000000000C60000-0x0000000000C88000-memory.dmp
memory/1132-19-0x00000000009A0000-0x00000000009B2000-memory.dmp
memory/1132-15-0x00000000009A0000-0x00000000009B2000-memory.dmp
memory/1132-20-0x0000000000C60000-0x0000000000C88000-memory.dmp
memory/1132-21-0x0000000002A90000-0x0000000002DDA000-memory.dmp
memory/1132-17-0x00000000009A0000-0x00000000009B2000-memory.dmp
memory/3472-0-0x000000007485E000-0x000000007485F000-memory.dmp
memory/3472-9-0x0000000074850000-0x0000000075000000-memory.dmp
memory/3472-1-0x0000000000930000-0x00000000009B4000-memory.dmp
memory/3472-8-0x0000000074850000-0x0000000075000000-memory.dmp
memory/3472-5-0x00000000055F0000-0x0000000005626000-memory.dmp
memory/3472-4-0x0000000005400000-0x0000000005436000-memory.dmp
memory/3472-3-0x0000000074850000-0x0000000075000000-memory.dmp
memory/3472-2-0x00000000052F0000-0x0000000005382000-memory.dmp
memory/3492-22-0x0000000002EF0000-0x0000000002FFB000-memory.dmp
memory/3492-14-0x0000000002EF0000-0x0000000002FFB000-memory.dmp
memory/3492-28-0x0000000008950000-0x0000000008A80000-memory.dmp
memory/3492-29-0x0000000008950000-0x0000000008A80000-memory.dmp
memory/3492-31-0x0000000008950000-0x0000000008A80000-memory.dmp
memory/4588-12-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4588-13-0x0000000002BD0000-0x0000000002BE1000-memory.dmp
memory/4588-10-0x0000000002880000-0x0000000002BCA000-memory.dmp
memory/4588-6-0x0000000000400000-0x0000000000428000-memory.dmp