xloader | f554af43cf1397d00309fdb967a62a825f4cf06100bab5e8fff17a9faa56d0f7

General

Target

d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe
Size

1.4MB
MD5

d24fc8737f2e7f453fe3688ac4c39736
SHA1

dc7b7a4ba33610500900d76e871523c2d1fb9f65
SHA256

f554af43cf1397d00309fdb967a62a825f4cf06100bab5e8fff17a9faa56d0f7
SHA512

a9c49f600277f40800036208c57e81cc844bab33f1860fbe0162f75a2d2c2574b9d3a987c996e9b793e1071b9663f69bdf3322036ee71e8935778be96a7086fd
SSDEEP

12288:ReaRNdAHjDJW7nUyeSqffN8Yj1pmjEd53kJSr1sRYAT2fXkk/HmUVpmldEVRCG:RnR8HmfqfV5jyjEd5OYAT2fXkvOH

Score

10^/10

xloader earz discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

earz

Decoy

halacoupon.com

anthos-labs.com

hagertylabs.net

l1992.com

856379580.xyz

rcbb-technologies.com

realhoggapparel.com

sauceprince.com

tootingcab.com

4chase5.com

ordergogibibimbap.com

nyj.xyz

dermixspa.com

premiergiftingco.com

razorcentric.com

mbrealtyadvisors.com

officialjazz.club

cctv006.com

hbcuatthepolls.info

prestamos-ya.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2528-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 2528	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	32

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe
3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe
3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe
3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe
2528	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2752	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	30
PID 3004 wrote to memory of 2752	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	30
PID 3004 wrote to memory of 2752	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	30
PID 3004 wrote to memory of 2752	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	30
PID 3004 wrote to memory of 2532	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	31
PID 3004 wrote to memory of 2532	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	31
PID 3004 wrote to memory of 2532	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	31
PID 3004 wrote to memory of 2532	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	31
PID 3004 wrote to memory of 2528	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	32
PID 3004 wrote to memory of 2528	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	32
PID 3004 wrote to memory of 2528	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	32
PID 3004 wrote to memory of 2528	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	32
PID 3004 wrote to memory of 2528	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	32
PID 3004 wrote to memory of 2528	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	32
PID 3004 wrote to memory of 2528	3004	d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe"
  2⤵
  PID:2752
- C:\Users\Admin\AppData\Local\Temp\d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe"
  2⤵
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d24fc8737f2e7f453fe3688ac4c39736_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-14-0x0000000000970000-0x0000000000C73000-memory.dmp

Filesize
3.0MB

Download
memory/2528-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2528-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3004-3-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/3004-6-0x0000000005650000-0x00000000056F0000-memory.dmp

Filesize
640KB

Download
memory/3004-7-0x0000000000730000-0x000000000075E000-memory.dmp

Filesize
184KB

Download
memory/3004-5-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/3004-4-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/3004-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/3004-2-0x00000000004B0000-0x00000000004CE000-memory.dmp

Filesize
120KB

Download
memory/3004-13-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/3004-1-0x0000000000100000-0x0000000000268000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing