Analysis
-
max time kernel
94s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-01-2025 01:13
General
-
Target
JaffaCakes118_05d6732ff73403961d2b131ac1237393.exe
-
Size
328KB
-
MD5
05d6732ff73403961d2b131ac1237393
-
SHA1
6bbfde0a9600bc7b5a5fdb04b2fb308d683b338d
-
SHA256
d3a9a3edb7bf2c1c0bee319acb384b4ea0d27a72c09ee0781996ecc4b6637fef
-
SHA512
1041901d78cd8345e665f4e81fa40e486eb4a762e28216e85755a08818fea1b593fa0053bef3aaf55df317675a02b2ce1f4f53cdaefcd10d4bc038baf253af09
-
SSDEEP
6144:nTo3T9zMROMLxpMqCaqSb/d0SqX7tNfVXVHQLIiu8c:nTk9zMROMLxzN70SwZGEX8c
Malware Config
Extracted
xloader
2.5
bs8f
vasilnikov.com
parkate.club
pol360.com
handmadequatang.com
consult-set.com
nourkoki.com
theveganfusspot.com
dreamssail.com
pinpinyouqian.xyz
satellitphonestore.com
yotosunny.com
telosaolympics.com
gogetemm.com
yozotnpasumo2.xyz
avantgardemarket.com
glenndcp.com
dirtydriverz.com
avaui.com
anchoredtheblog.com
marianaoliveiraarquitetura.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload 3 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05d6732ff73403961d2b131ac1237393.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05d6732ff73403961d2b131ac1237393.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 2802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3648 -ip 36481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
128KB
-
Filesize
43.1MB