xloader | 4de35ea5d1f54708e27e4806246a6c9d9b2217cfef24c7b2321a8f6026c5d98c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/01/2025, 19:48 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_371c76d36256463a54d34e12d6741720.exe
Size

251KB
MD5

371c76d36256463a54d34e12d6741720
SHA1

41843093a5b3a7f5712abd30937004b203851252
SHA256

4de35ea5d1f54708e27e4806246a6c9d9b2217cfef24c7b2321a8f6026c5d98c
SHA512

f2e87fb4628a8b413ced0d92bcedafc4667e8655ac2c13fa15b7f806ddd19daec919003da80f4157f83e5a24b24a4ccac98c2dfd351227b6a549443c8e7c5759
SSDEEP

6144:wBlL/cR8tpViH8hHseEJ1eG6/211J5nQEnURg0HZoAA:CeRSpNhH1EGZc5tURggZoAA

Score

10^/10

xloader m5cw discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m5cw

Decoy

stolpfabriken.com

aromaessentialco.com

rmcclaincpa.com

wuruixin.com

sidhyanticlasses.com

horilka.store

organic-outlaws.com

customsoftwarelogistics.com

cheryltesting.com

thecompacthomegym.com

the22yards.club

quickloanprovidersservices.com

grippyent.com

guard-usa.com

agircredit.com

classificationmetallurgie.com

quizzesandcode.com

catdanos.com

8676789.rest

gotbestshavlngplansforyou.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/280-9-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

pid	Process
2024	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 280	2024	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
280	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 280	2024	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe	31
PID 2024 wrote to memory of 280	2024	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe	31
PID 2024 wrote to memory of 280	2024	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe	31
PID 2024 wrote to memory of 280	2024	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe	31
PID 2024 wrote to memory of 280	2024	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe	31
PID 2024 wrote to memory of 280	2024	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe	31
PID 2024 wrote to memory of 280	2024	JaffaCakes118_371c76d36256463a54d34e12d6741720.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_371c76d36256463a54d34e12d6741720.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_371c76d36256463a54d34e12d6741720.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_371c76d36256463a54d34e12d6741720.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_371c76d36256463a54d34e12d6741720.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstDC4C.tmp\ztqv.dll

Filesize
32KB

MD5
97d84d39bb68b5a29e976b40d7d0a00c

SHA1
cf4c09487fffb9ace9ab6b82f33da0d5a851ef1c

SHA256
5b29c5ee49d9cdde15d88a9e4f8f6b4bba9e2dc4ec65c02d734726fe0f2952c8

SHA512
aab5b8831538f96c00e77f16349065bfaa93e7b25206a6d5fe0871f518f38ae31437f2f9f93f36f488e1869eaf97dd4697a282d726ce9a292cf4276242733546

Download Submit
memory/280-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2024-7-0x0000000010008000-0x000000001000A000-memory.dmp

Filesize
8KB

Download