xloader | 9be04bb6af5b7e9fe3073b948c345eee2491d61c985997d681ea253c7b62aa4c

General

Target

fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
Size

1.2MB
MD5

fe346737f236e64f7b1f0120cf4fd261
SHA1

6901215d58e95a7bf12c0507c528f77d1c6329a4
SHA256

9be04bb6af5b7e9fe3073b948c345eee2491d61c985997d681ea253c7b62aa4c
SHA512

4753b08ebf22f06c31d1123fbdec5578d3b57805af512ecb42ad89c263d4094e35c2ed453039c15e06031c7bd49ab8b3a6ea053d7eb5cb6a6e57bfa05b1c760b
SSDEEP

24576:NPzcW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hub:piecbzhBmLCQv8M

Score

10^/10

xloader jeiq loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

jeiq

Decoy

casuallyso.com

mismirasoles.com

nunostacos.com

zboubdiel.com

eternellebynh.com

radsum.info

sddianshang56.com

citriodiolspray.com

khoza3a.com

reelhooker-phuket.com

pumpbrokers.com

wallstreetbnb.com

realestatewithtiff.com

rockstarleading.com

goddesslovebeauty.com

zulaolao.com

openwateradventurers.com

xn--zqsv0e44iqw9c.space

lingxiaojiaoyu.com

wetrabbitexpress.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/400-13-0x0000000000400000-0x0000000000428000-memory.dmp xloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe

description pid process target process

PID 2440 set thread context of 400 2440 fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/400-13-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

description	pid	process	target process
PID 2440 set thread context of 400	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exefe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe

pid	process
2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
400	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
400	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2440 fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Local\Temp\fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe"
2⤵
PID:2736

C:\Users\Admin\AppData\Local\Temp\fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe"
2⤵
PID:5008

C:\Users\Admin\AppData\Local\Temp\fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe"
2⤵
PID:2232

C:\Users\Admin\AppData\Local\Temp\fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/400-17-0x0000000001120000-0x000000000146A000-memory.dmp

Filesize
3.3MB

Download
memory/400-16-0x0000000001120000-0x000000000146A000-memory.dmp

Filesize
3.3MB

Download
memory/2440-8-0x0000000074A20000-0x00000000751D0000-memory.dmp

Filesize
7.7MB

Download
memory/2440-10-0x00000000050A0000-0x00000000050D6000-memory.dmp

Filesize
216KB

Download
memory/2440-7-0x0000000005AD0000-0x0000000005B26000-memory.dmp

Filesize
344KB

Download
memory/2440-3-0x0000000005D10000-0x00000000062B4000-memory.dmp

Filesize
5.6MB

Download
memory/2440-0-0x0000000000CF0000-0x0000000000E2A000-memory.dmp

Filesize
1.2MB

Download
memory/2440-2-0x00000000056C0000-0x000000000575C000-memory.dmp

Filesize
624KB

Download
memory/2440-9-0x0000000005970000-0x0000000005980000-memory.dmp

Filesize
64KB

Download
memory/2440-6-0x0000000005930000-0x000000000593A000-memory.dmp

Filesize
40KB

Download
memory/2440-11-0x0000000001630000-0x00000000016AC000-memory.dmp

Filesize
496KB

Download
memory/2440-12-0x0000000001570000-0x00000000015A2000-memory.dmp

Filesize
200KB

Download
memory/2440-5-0x0000000005970000-0x0000000005980000-memory.dmp

Filesize
64KB

Download
memory/2440-15-0x0000000074A20000-0x00000000751D0000-memory.dmp

Filesize
7.7MB

Download
memory/2440-4-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/2440-1-0x0000000074A20000-0x00000000751D0000-memory.dmp

Filesize
7.7MB

Download

description	pid	process	target process
PID 2440 wrote to memory of 2736	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 2736	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 2736	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 5008	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 5008	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 5008	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 2232	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 2232	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 2232	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 400	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 400	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 400	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 400	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 400	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe
PID 2440 wrote to memory of 400	2440	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe	fe346737f236e64f7b1f0120cf4fd261_JaffaCakes118.exe

Analysis

Sharing