Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2024 17:37
Static task
static1
Behavioral task
behavioral1
Sample
3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe
-
Size
467KB
-
MD5
3605e9de6e1e1b63ce9c4b6b25e4bce2
-
SHA1
415604ecf117acd31735592e1450c72baa1344c9
-
SHA256
b49d507a9840371642282e2d4a6b878f01a47265ece636e9380c7a4682a9c46a
-
SHA512
d728bc59a94680ae280f03a92f129551a83fba2ac4ab384e8cb155068157c5b3149bb8127a7fe11b4bbb68f7617fb5c9484e6093c8b185bb853f311d53adef28
-
SSDEEP
6144:807O/lGq3T7SzJqq4OoAqYwLw7puaP+Xoc52XEGafCLvIdn1f0SQddTZTbxpWMAE:TjYT7A4soCx2YrUVUvIdn6dTVW
Malware Config
Extracted
xloader
2.4
cxeo
realtyfindr.com
littlelakesranchcattle.com
mortgagecollective.online
cortenlogistic.com
healthcaresupplyinc.com
abc1229.com
johnlambertsen.online
yasirweb.tech
1398toftsdr.com
chordsofdevils.com
hemetcondos4sale.com
hdtvstoreonline.com
ultimasnoticiaswfmajide2.xyz
soutu6.com
lastmilefast.com
glveye.icu
countinesices.com
savenroar.com
reiwa.cloud
wendsoue.com
rechargehealthco.com
aw6szfrr.xyz
bws-coaching.xyz
cunjvogr.xyz
royalcasino247.com
dshlsc.com
henews.xyz
bouncehousecoral.com
muskokaqualitymaintenance.com
missnco.com
04x5bnr9x8lz.com
base2sin.xyz
flisvoshotel.com
dieteticapeperina.online
mfmasap.com
virusbustersusa.com
noodleboardfrenzy.com
avaeagle.com
infinitikloud.tech
epoxyprosarizona.com
statiproshop.com
g8ti416orb.com
monica-blanco.com
boutechpro.xyz
launchandthriveonline.com
bygning.info
iloveasia.net
swartz.center
circuit.run
thegiftoftrading.com
waploaded.xyz
howtobuyxrpcrypto.com
suchatleb.com
santinoalcalina.com
vepcode.com
rocinanteranch.com
valonour.com
etproof.com
hackettwealth.management
ygm-joyas.com
swagat-restaurant.info
joocyvault.com
mkrdp.com
totojie.com
gretsel.com
Signatures
-
Xloader payload 1 IoCs
resource yara_rule behavioral2/memory/3640-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4724 set thread context of 3640 4724 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4724 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe 4724 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe 3640 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe 3640 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4724 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4724 wrote to memory of 3640 4724 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe 88 PID 4724 wrote to memory of 3640 4724 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe 88 PID 4724 wrote to memory of 3640 4724 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe 88 PID 4724 wrote to memory of 3640 4724 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe 88 PID 4724 wrote to memory of 3640 4724 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe 88 PID 4724 wrote to memory of 3640 4724 3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3605e9de6e1e1b63ce9c4b6b25e4bce2_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3640
-