Malware Analysis Report

2024-10-19 02:16

Sample ID 241009-jcdj6athkq
Target 2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118
SHA256 ab4795f656b54e9388c89d6a4df52747510fa418bdb50aa3bafd7b332ef1ff81
Tags
discovery xloader rqe8 loader rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ab4795f656b54e9388c89d6a4df52747510fa418bdb50aa3bafd7b332ef1ff81

Threat Level: Known bad

The file 2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery xloader rqe8 loader rat

Xloader

Xloader payload

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-09 07:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-09 07:31

Reported

2024-10-09 19:11

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1796 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe
PID 1796 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe"

Network

N/A

Files

memory/1796-0-0x000000007463E000-0x000000007463F000-memory.dmp

memory/1796-1-0x00000000003A0000-0x00000000004F4000-memory.dmp

memory/1796-2-0x0000000074630000-0x0000000074D1E000-memory.dmp

memory/1796-3-0x0000000000500000-0x000000000051E000-memory.dmp

memory/1796-4-0x000000007463E000-0x000000007463F000-memory.dmp

memory/1796-5-0x0000000074630000-0x0000000074D1E000-memory.dmp

memory/1796-6-0x00000000058A0000-0x0000000005940000-memory.dmp

memory/1796-7-0x0000000001E00000-0x0000000001E2E000-memory.dmp

memory/1796-8-0x0000000074630000-0x0000000074D1E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-09 07:31

Reported

2024-10-09 19:12

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe"

Signatures

Xloader

loader xloader

Xloader payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2d401eff3fb7e3d78d85727e0235e5c3_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 101.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/4836-0-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

memory/4836-1-0x0000000000D50000-0x0000000000EA4000-memory.dmp

memory/4836-2-0x0000000005D90000-0x0000000006334000-memory.dmp

memory/4836-3-0x0000000005880000-0x0000000005912000-memory.dmp

memory/4836-4-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/4836-5-0x0000000005860000-0x000000000586A000-memory.dmp

memory/4836-6-0x0000000006F50000-0x0000000006FEC000-memory.dmp

memory/4836-7-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

memory/4836-8-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

memory/4836-9-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/4836-10-0x0000000006EB0000-0x0000000006F50000-memory.dmp

memory/4836-11-0x0000000009680000-0x00000000096AE000-memory.dmp

memory/1428-12-0x0000000000400000-0x0000000000428000-memory.dmp

memory/4836-14-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/1428-15-0x0000000001220000-0x000000000156A000-memory.dmp