xloader | b4bb472d39c592fc4e99ecdd59cc1284255666c72ba5eccc7f5b39780e53141e

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
Size

418KB
MD5

f97387cf1ed097f9f1185ecb8d63d425
SHA1

a737798f98adfedab12d1b8161ebfc0db31767da
SHA256

b4bb472d39c592fc4e99ecdd59cc1284255666c72ba5eccc7f5b39780e53141e
SHA512

b8aadb681f1e492bea50f722d34a431c5fb46c32fdb23ca54f5bc43474672dae49ef95d3e3188b739561b6f76c8d05b1ab07d34473da2c3a1dcfff18a866185d
SSDEEP

6144:3LTfaVy5OOu+n20JpbO8yfyV68lyixJQ0KDJNXiTF85rDcp0+DMC:vfalOu+n/U8c50WNCFy3x+QC

Score

10^/10

xloader b6a4 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

b6a4

Decoy

reviewsresolutions.com

binhminhgardenshophouse.com

nebulacom.com

kadhambaristudio.com

viltoom.club

supmomma.com

tjszxddc.com

darlingmemories.com

hyperultrapure.com

vibembrio.com

reallycoolmask.com

cumbukita.com

brian-newby.com

abstractaccessories.com

marykinky.com

minnesotareversemtgloans.com

prasetlement.com

xplpgi.com

xn--gdask-y7a.com

uababaseball.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/3040-3-0x0000000000510000-0x0000000000538000-memory.dmp xloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe

description pid process target process

PID 116 set thread context of 3040 116 f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe

pid process

3040 f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
3040 f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe

pid process

116 f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
116 f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/3040-3-0x0000000000510000-0x0000000000538000-memory.dmp	xloader

description	pid	process	target process
PID 116 set thread context of 3040	116	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe

pid	process
3040	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
3040	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe

pid	process
116	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
116	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe

description	pid	process	target process
PID 116 wrote to memory of 3040	116	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
PID 116 wrote to memory of 3040	116	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
PID 116 wrote to memory of 3040	116	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
PID 116 wrote to memory of 3040	116	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe	f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:116

C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/116-1-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/116-2-0x00000000012C0000-0x00000000012C2000-memory.dmp

Filesize
8KB

Download
memory/3040-3-0x0000000000510000-0x0000000000538000-memory.dmp

Filesize
160KB

Download
memory/3040-6-0x0000000000CB0000-0x0000000000FFA000-memory.dmp

Filesize
3.3MB

Download
memory/3040-7-0x0000000000CB0000-0x0000000000FFA000-memory.dmp

Filesize
3.3MB

Download