xloader | c3dad4eb294afef3dd4251826c1c1d25679c1044120e8bfaaea14e582be06357

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe
Size

885KB
MD5

fdefb10ff2bb3ab90dd75cca967e31cf
SHA1

909d8032fcca825c3d76743236bcd569c734624b
SHA256

c3dad4eb294afef3dd4251826c1c1d25679c1044120e8bfaaea14e582be06357
SHA512

d517c53f2b95d1140b385eddf0c34c973ed79e7fc71100943a05130b8ba0ccd6213864bcf938f7ff83c2aed8a1c9168bf9a775d1c13b3490b7d591e47835bdca
SSDEEP

12288:wlDc9F3nC0Py3gAh5F/O1sZpouildw4dy33uFfRoSLu4AgDvXmCGhj2ncpI40E71:whxShldzy33+zLxvXmIK7qPiz5

Score

10^/10

xloader n58i loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

n58i

Decoy

nl-cafe.com

votetedjaleta.com

britrobertsrealtor.com

globipark.com

citysucces.com

verisignwebsite-verified.com

riddlepc.com

rosecityclimbing.com

oleandrinextract.com

salmankonstruksi.com

needhamchannel.com

refreshx2z.com

youth66.com

pla-russia.com

halloweenmaskpro.com

exdysis.com

1gcz.com

lookgoodman.com

rlxagva.com

stlcityc.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2576-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe

description pid process target process

PID 2416 set thread context of 2576 2416 fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2692 2576 WerFault.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe

pid process

2416 fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2416 fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2576-13-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

description	pid	process	target process
PID 2416 set thread context of 2576	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe	RegSvcs.exe

pid	pid_target	process	target process
2692	2576	WerFault.exe	RegSvcs.exe

pid	process
2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exeRegSvcs.exe

description	pid	process	target process
PID 2416 wrote to memory of 2576	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe	RegSvcs.exe
PID 2416 wrote to memory of 2576	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe	RegSvcs.exe
PID 2416 wrote to memory of 2576	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe	RegSvcs.exe
PID 2416 wrote to memory of 2576	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe	RegSvcs.exe
PID 2416 wrote to memory of 2576	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe	RegSvcs.exe
PID 2416 wrote to memory of 2576	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe	RegSvcs.exe
PID 2416 wrote to memory of 2576	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe	RegSvcs.exe
PID 2416 wrote to memory of 2576	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe	RegSvcs.exe
PID 2416 wrote to memory of 2576	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe	RegSvcs.exe
PID 2416 wrote to memory of 2576	2416	fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe	RegSvcs.exe
PID 2576 wrote to memory of 2692	2576	RegSvcs.exe	WerFault.exe
PID 2576 wrote to memory of 2692	2576	RegSvcs.exe	WerFault.exe
PID 2576 wrote to memory of 2692	2576	RegSvcs.exe	WerFault.exe
PID 2576 wrote to memory of 2692	2576	RegSvcs.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdefb10ff2bb3ab90dd75cca967e31cf_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 36
3⤵
- Program crash
PID:2692

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-6-0x0000000005670000-0x0000000005720000-memory.dmp

Filesize
704KB

Download
memory/2416-0-0x0000000000FE0000-0x00000000010C4000-memory.dmp

Filesize
912KB

Download
memory/2416-2-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/2416-3-0x00000000003F0000-0x0000000000408000-memory.dmp

Filesize
96KB

Download
memory/2416-4-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-5-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/2416-1-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-7-0x0000000000A90000-0x0000000000AD2000-memory.dmp

Filesize
264KB

Download
memory/2416-14-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download
memory/2576-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2576-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2576-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2576-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download