xloader | dc5f7d89ab2465597ff7fa9f544326613aeaab2afa6e2e457ba5fc0da15bd450

General

Target

f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
Size

227KB
MD5

f206abfc024129f1af253e5417f139d7
SHA1

2c7e574dcc970a2c4652257958873ffcd4c3aa1c
SHA256

dc5f7d89ab2465597ff7fa9f544326613aeaab2afa6e2e457ba5fc0da15bd450
SHA512

121bb9f8a27bf8a0d15066836ba6dd0a5e37ef588b594d649b91fb9fd0793fadf4f836f0c7ede476912dde6f8b6de9b7ca1c4e39050cdec93bf2d59c33333354
SSDEEP

6144:ix/MjhXma3OPaflAP5Ft6rozvYR5FrBRf8pXLMjekuK/PeMqN:GDa3ua9FrBILpK/Pzg

Score

10^/10

xloader cna8 discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

cna8

Decoy

exceptionalhospital.com

agshorizon.com

sabaisurfing.com

kathrynprosser.com

news-roma.com

lareinadelosalisados.com

iregretnotcomingupwithit.com

dreamwrldrp.com

brickhallschool-ng.com

exgobal.com

ojcllc.com

pineviewsunrise.com

ru-joking.com

theparkplasticsurgery.com

mouthsecond.today

princessmasksandapparel.com

onlinedavetiyecim.com

animegirls.xyz

heicat.club

brazillianallstars.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2328-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 2 IoCs

Processes:

f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

pid process

2524 f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
2524 f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

description	pid	process	target process
PID 2524 set thread context of 2328	2524	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

f206abfc024129f1af253e5417f139d7_JaffaCakes118.exef206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

pid	process
2524	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
2524	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
2524	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
2524	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
2328	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

pid process

2524 f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

description	pid	process	target process
PID 2524 wrote to memory of 2328	2524	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
PID 2524 wrote to memory of 2328	2524	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
PID 2524 wrote to memory of 2328	2524	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
PID 2524 wrote to memory of 2328	2524	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
PID 2524 wrote to memory of 2328	2524	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe	f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f206abfc024129f1af253e5417f139d7_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\5oqtt4jdequ.dll

Filesize
10KB

MD5
38c374a4ca22eb658fb1c4549c12108e

SHA1
c36a2dc7b48264b0bfcb256393770556dbece03d

SHA256
e1b2a995ff9d38bab0662cddf32e9160911f7a4a8b465f88ec62b8fd59bbce5d

SHA512
0f78f39c54b594c8f58fe47740a6d2bb83acb25b0678eb07060f30f18533d34d3dde9bdd8a65042b0b6a0eab6fa00e83216142033ca633a1d4642386488f5979

Download Submit
\Users\Admin\AppData\Local\Temp\nso9B47.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/2328-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2524-11-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads