Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
02/01/2026, 19:16
General
- Target JaffaCakes118_3eec66e80f478d2730d7e128d393460d.exe
- Size 887KB
- Sample260102-xyvmfsal2x
- SHA256 6acec5800bb6a457e47029754e9eb7d6bf405ff56ea9f074741dabfdac141c18
Malware Config
Extracted
-
xloader
-
2.3
-
ehxh
-
financialaccompany.com
-
face2bouk.com
-
blazedisinfecting.com
-
providaconsultinggroup.com
-
distriautosdelpacifico.com
-
myaduhelm.com
-
thangmaygiatot.com
-
nuevasantatecla.com
-
endpedophiles.com
-
alwanps.com
-
anzi-studio.com
-
twoswinginghammers.com
-
curbedinc.com
-
purecleantn.com
-
4levelsplit.com
-
talklinecall.com
-
egypte-vakanties.com
-
xzntfwof.icu
-
sosyoclassic.com
-
adjoalearningacademy.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader family
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3eec66e80f478d2730d7e128d393460d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3eec66e80f478d2730d7e128d393460d.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3eec66e80f478d2730d7e128d393460d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3eec66e80f478d2730d7e128d393460d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4760-0-0x00000000008A0000-0x0000000000984000-memory.dmp
memory/4760-1-0x00000000053D0000-0x000000000546C000-memory.dmp
memory/4760-2-0x0000000005A20000-0x0000000005FC6000-memory.dmp
memory/4760-3-0x0000000005510000-0x00000000055A2000-memory.dmp
memory/4760-4-0x00000000056A0000-0x00000000056B0000-memory.dmp
memory/4760-5-0x00000000054D0000-0x00000000054DA000-memory.dmp
memory/4760-6-0x0000000005710000-0x0000000005766000-memory.dmp
memory/4760-7-0x00000000056C0000-0x00000000056E8000-memory.dmp
memory/4760-8-0x00000000056A0000-0x00000000056B0000-memory.dmp
memory/4760-9-0x0000000006420000-0x0000000006488000-memory.dmp
memory/5664-10-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5664-12-0x0000000001A60000-0x0000000001DB6000-memory.dmp