xloader | 811745e059225a9d2c1e3a283c2895589f36332a5e90c6cbe3425b841b3b024d

General

Target

0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe
Size

881KB
MD5

0cc094b93ea3fe9dcf1897e41d8ef875
SHA1

26a40e556b826052196a2bcea93d1962ea1a6eaf
SHA256

811745e059225a9d2c1e3a283c2895589f36332a5e90c6cbe3425b841b3b024d
SHA512

c98f2a184be3d15a7dbb3c7d882d3a8848dfd6709e461457ba84170a7ceea558f6494ab73c397144091e1715add5623b611c48078576c44c44a509425898c091
SSDEEP

12288:Y94in3qGaNHEyC9/oR9gy5ZHK7zWQDLDhjiKznNWOoyw1rFYi/tOfeAD7GK:8Pp9AR95SlLDxn0ORw1xYSt7e7GK

Score

10^/10

xloader q4kr discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

q4kr

Decoy

realmodapk.com

hanoharuka.com

shivalikspiritualproducts.com

womenshealthclinincagra.com

racketpark.com

startuporig.com

azkachinas.com

klanblog.com

linuxradio.tools

siteoficial-liquida.com

glsbuyer.com

bestdeez.com

teens2cash.com

valleyviewconstruct.com

myfortniteskins.com

cambecare.com

csec2011.com

idookap.com

warmwallsrecords.com

smartmirror.one

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2784-15-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2784-19-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2784-23-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 2784	1924	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe	31
PID 2784 set thread context of 1208	2784	RegSvcs.exe	21
PID 2784 set thread context of 1208	2784	RegSvcs.exe	21

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2784	RegSvcs.exe
2784	RegSvcs.exe
2784	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2784	RegSvcs.exe
2784	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	RegSvcs.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2784	1924	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2784	1924	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2784	1924	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2784	1924	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2784	1924	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2784	1924	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2784	1924	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2784	1924	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2784	1924	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2784	1924	0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-28-0x0000000004BF0000-0x0000000004CEA000-memory.dmp

Filesize
1000KB

Download
memory/1208-26-0x0000000004BF0000-0x0000000004CEA000-memory.dmp

Filesize
1000KB

Download
memory/1208-27-0x0000000006490000-0x00000000065B7000-memory.dmp

Filesize
1.2MB

Download
memory/1208-21-0x0000000006490000-0x00000000065B7000-memory.dmp

Filesize
1.2MB

Download
memory/1924-3-0x00000000002F0000-0x0000000000306000-memory.dmp

Filesize
88KB

Download
memory/1924-5-0x00000000740C0000-0x00000000747AE000-memory.dmp

Filesize
6.9MB

Download
memory/1924-6-0x0000000007D90000-0x0000000007E2C000-memory.dmp

Filesize
624KB

Download
memory/1924-7-0x0000000000690000-0x00000000006BE000-memory.dmp

Filesize
184KB

Download
memory/1924-4-0x00000000740CE000-0x00000000740CF000-memory.dmp

Filesize
4KB

Download
memory/1924-2-0x00000000740C0000-0x00000000747AE000-memory.dmp

Filesize
6.9MB

Download
memory/1924-0-0x00000000740CE000-0x00000000740CF000-memory.dmp

Filesize
4KB

Download
memory/1924-1-0x00000000001D0000-0x00000000002B2000-memory.dmp

Filesize
904KB

Download
memory/1924-16-0x00000000740C0000-0x00000000747AE000-memory.dmp

Filesize
6.9MB

Download
memory/2784-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2784-20-0x0000000000170000-0x0000000000180000-memory.dmp

Filesize
64KB

Download
memory/2784-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2784-17-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

Filesize
3.0MB

Download
memory/2784-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2784-24-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/2784-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2784-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2784-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing