xloader | 03bef4cce37594b14884c28536f8247413f51286388528e6f0c6c6de27106cde

Analysis

max time kernel
38s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe
Size

481KB
MD5

853ef1dd6f3f39f1cb4730d5b4c92788
SHA1

d21e15ce6e8792f4f643601d1ad1173c87e882be
SHA256

03bef4cce37594b14884c28536f8247413f51286388528e6f0c6c6de27106cde
SHA512

d5f17a2c0d920a843e21a60598080b801acbe966226debd25016651192853c38ca8091a620d328d0c48de31139136a2327cb1fbb9f12821c079e834120b4a50e
SSDEEP

12288:M1nTXR0DY3UKZ9nBkOCOaw30ChpYzVEfFn+rzh1TqvX9slNVH9f3gWo84y626L/T:cnzjqo3j

Score

10^/10

xloader g2pg discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

g2pg

Decoy

xzq151516.net

ijournaltnpasumo5.xyz

hoclconsultantions.com

orcasdefense.com

businessvalues.online

popkidscollection.com

xn--sargelinemlak-59b.com

filmschool.asia

yalding.com

az-property-solutions.com

dnahotcars.com

cunnters.com

rkmuscles.com

artshowespelhos.com

tagfat.online

kenganashura.net

ayelenpsicologa.com

hotelmipetate.com

etuwrestling.com

von-wehner.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2892-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1176 set thread context of 2892	1176	JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2892	JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2892	1176	JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe	29
PID 1176 wrote to memory of 2892	1176	JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe	29
PID 1176 wrote to memory of 2892	1176	JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe	29
PID 1176 wrote to memory of 2892	1176	JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe	29
PID 1176 wrote to memory of 2892	1176	JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe	29
PID 1176 wrote to memory of 2892	1176	JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe	29
PID 1176 wrote to memory of 2892	1176	JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe	29

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853ef1dd6f3f39f1cb4730d5b4c92788.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-6-0x00000000047C0000-0x0000000004812000-memory.dmp

Filesize
328KB

Download
memory/1176-1-0x0000000000090000-0x000000000010E000-memory.dmp

Filesize
504KB

Download
memory/1176-2-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/1176-3-0x0000000001F40000-0x0000000001F4E000-memory.dmp

Filesize
56KB

Download
memory/1176-4-0x00000000749AE000-0x00000000749AF000-memory.dmp

Filesize
4KB

Download
memory/1176-5-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/1176-0-0x00000000749AE000-0x00000000749AF000-memory.dmp

Filesize
4KB

Download
memory/1176-12-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/2892-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2892-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2892-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2892-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2892-13-0x0000000000A20000-0x0000000000D23000-memory.dmp

Filesize
3.0MB

Download