xloader | 85d66b1ddbd5ebdb7be3883335db72866c2c3a51f96a81655af51e6f139bb228

General

Target

fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
Size

1.3MB
MD5

fa84498e7c2f782eb7e2fbc031f70859
SHA1

cbc9482a3e102f8f2f76b07424b7580c475e7900
SHA256

85d66b1ddbd5ebdb7be3883335db72866c2c3a51f96a81655af51e6f139bb228
SHA512

36e32b1df238c22840b8d1dc9351fe13ce538bd4efe3a2a31d6673404133457c2084e8bd9a3cda15f5b71c88e16261f3884036042d0975b8feabf21079413b62
SSDEEP

24576:sQ1ftboSzyRuGj6N/i44rhXZNus89UrmMnfk/iQ2+S0dS:syt/MuhbcWsaU9fk/Pjg

Score

10^/10

xloader h388 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

h388

Decoy

americangrindstone.com

qdy6.club

bestsecretrecipes.info

11restoran.com

mrhashtags.com

theexecutivestudio.com

levilatte.com

indiantrio.com

msdhigh.com

spartandiesel.com

soccersundays.com

eliteworldcars.com

superlemon001.com

greenlight.school

kuryeforum.xyz

abc-322.com

campbellretreat.com

argonmode.net

movievilla.info

brateix.info

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/1384-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe

description pid process target process

PID 3220 set thread context of 1384 3220 fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/1384-13-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

description	pid	process	target process
PID 3220 set thread context of 1384	3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exefa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe

pid	process
3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
1384	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
1384	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3220 fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe

description	pid	process	target process
PID 3220 wrote to memory of 3944	3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
PID 3220 wrote to memory of 3944	3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
PID 3220 wrote to memory of 3944	3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
PID 3220 wrote to memory of 1384	3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
PID 3220 wrote to memory of 1384	3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
PID 3220 wrote to memory of 1384	3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
PID 3220 wrote to memory of 1384	3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
PID 3220 wrote to memory of 1384	3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
PID 3220 wrote to memory of 1384	3220	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe	fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220

C:\Users\Admin\AppData\Local\Temp\fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe"
2⤵
PID:3944

C:\Users\Admin\AppData\Local\Temp\fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa84498e7c2f782eb7e2fbc031f70859_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1384-17-0x0000000001480000-0x00000000017CA000-memory.dmp

Filesize
3.3MB

Download
memory/1384-16-0x0000000001480000-0x00000000017CA000-memory.dmp

Filesize
3.3MB

Download
memory/3220-8-0x0000000002DF0000-0x0000000002E08000-memory.dmp

Filesize
96KB

Download
memory/3220-10-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/3220-5-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/3220-6-0x00000000055A0000-0x00000000055AA000-memory.dmp

Filesize
40KB

Download
memory/3220-7-0x0000000005800000-0x0000000005856000-memory.dmp

Filesize
344KB

Download
memory/3220-0-0x0000000000A00000-0x0000000000B5E000-memory.dmp

Filesize
1.4MB

Download
memory/3220-9-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/3220-4-0x0000000005670000-0x0000000005702000-memory.dmp

Filesize
584KB

Download
memory/3220-11-0x000000000B660000-0x000000000B70A000-memory.dmp

Filesize
680KB

Download
memory/3220-12-0x000000000E710000-0x000000000E74A000-memory.dmp

Filesize
232KB

Download
memory/3220-3-0x0000000005B80000-0x0000000006124000-memory.dmp

Filesize
5.6MB

Download
memory/3220-15-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/3220-2-0x00000000054F0000-0x000000000558C000-memory.dmp

Filesize
624KB

Download
memory/3220-1-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing