xloader | 72320946e28ee9117b85cb1a83e5e122c3938e4a79c9be1551595103cb2c311a

General

Target

fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
Size

303KB
MD5

fea794d22d11c7eda7af63545fc5f9ba
SHA1

7d30f8fa2652c0e36a82fbbf6a5995bdb1d056f9
SHA256

72320946e28ee9117b85cb1a83e5e122c3938e4a79c9be1551595103cb2c311a
SHA512

49d6b9c8b7ca35652a72f949bf4cdf5dc5f595391db052786a6333befde7dbf28afe3dd9fda177135dc90fd45c46c00826f8a936d1458e6d91b6cd146124da55
SSDEEP

6144:UDsmb8RHBESKs3hnD13HIMq/3WdCVdKrL:UD8WSKsBDpaWdCi/

Score

10^/10

xloader att3 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

att3

Decoy

oakbridgefundservices.com

fancyforts.com

coisadoce.com

learnfrommymentor.com

digitalgurughana.com

phk0.com

jantiprojeekspertiz.com

xiabyhuc.com

todayonly8.info

pgzapgmn.icu

sistemasarafranco.com

nest-estudio.com

2259.xyz

kenobi.tech

mortgageloansbyjeff.com

thameensa.com

navigators.digital

ecocleanmalta.com

advancedrecyclinginc.com

pmotriz.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/3532-51-0x0000000000400000-0x0000000000429000-memory.dmp xloader

resource	yara_rule
behavioral2/memory/3532-51-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Drops startup file 2 IoCs

Processes:

PowerShell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sfgdfgdfd.exe	PowerShell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sfgdfgdfd.exe	PowerShell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe

description pid process target process

PID 544 set thread context of 3532 544 fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PowerShell.exefea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe

pid process

2804 PowerShell.exe
2804 PowerShell.exe
3532 fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
3532 fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PowerShell.exefea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2804 PowerShell.exe
Token: SeDebugPrivilege 544 fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe

description	pid	process	target process
PID 544 set thread context of 3532	544	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe

pid	process
2804	PowerShell.exe
2804	PowerShell.exe
3532	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
3532	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2804	PowerShell.exe
Token: SeDebugPrivilege	544	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe

description	pid	process	target process
PID 544 wrote to memory of 2804	544	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe	PowerShell.exe
PID 544 wrote to memory of 2804	544	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe	PowerShell.exe
PID 544 wrote to memory of 2804	544	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe	PowerShell.exe
PID 544 wrote to memory of 3532	544	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
PID 544 wrote to memory of 3532	544	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
PID 544 wrote to memory of 3532	544	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
PID 544 wrote to memory of 3532	544	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
PID 544 wrote to memory of 3532	544	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
PID 544 wrote to memory of 3532	544	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe	fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
"PowerShell" copy-item 'C:\Users\Admin\AppData\Local\Temp\fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sfgdfgdfd.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Users\Admin\AppData\Local\Temp\fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fea794d22d11c7eda7af63545fc5f9ba_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y3n4ikdb.xeo.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/544-30-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-47-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-3-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/544-4-0x0000000006120000-0x00000000066C4000-memory.dmp

Filesize
5.6MB

Download
memory/544-61-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/544-32-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-50-0x0000000005C60000-0x0000000005C61000-memory.dmp

Filesize
4KB

Download
memory/544-49-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-17-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-10-0x0000000005C20000-0x0000000005C3C000-memory.dmp

Filesize
112KB

Download
memory/544-13-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-12-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-2-0x00000000058D0000-0x000000000596C000-memory.dmp

Filesize
624KB

Download
memory/544-15-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-1-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/544-45-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-43-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-0-0x0000000000F00000-0x0000000000F52000-memory.dmp

Filesize
328KB

Download
memory/544-9-0x0000000005D40000-0x0000000005D50000-memory.dmp

Filesize
64KB

Download
memory/544-39-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-41-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/544-36-0x0000000005C20000-0x0000000005C35000-memory.dmp

Filesize
84KB

Download
memory/2804-34-0x0000000005C60000-0x0000000005FB4000-memory.dmp

Filesize
3.3MB

Download
memory/2804-5-0x0000000004B20000-0x0000000004B56000-memory.dmp

Filesize
216KB

Download
memory/2804-38-0x0000000006100000-0x000000000614C000-memory.dmp

Filesize
304KB

Download
memory/2804-7-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/2804-35-0x00000000060C0000-0x00000000060DE000-memory.dmp

Filesize
120KB

Download
memory/2804-28-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Filesize
408KB

Download
memory/2804-8-0x00000000051C0000-0x00000000057E8000-memory.dmp

Filesize
6.2MB

Download
memory/2804-59-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2804-18-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Filesize
408KB

Download
memory/2804-11-0x0000000005130000-0x0000000005152000-memory.dmp

Filesize
136KB

Download
memory/2804-6-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2804-53-0x0000000007070000-0x0000000007106000-memory.dmp

Filesize
600KB

Download
memory/2804-54-0x00000000065D0000-0x00000000065EA000-memory.dmp

Filesize
104KB

Download
memory/2804-55-0x00000000065F0000-0x0000000006612000-memory.dmp

Filesize
136KB

Download
memory/3532-52-0x0000000001940000-0x0000000001C8A000-memory.dmp

Filesize
3.3MB

Download
memory/3532-51-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing