xloader | 652ed909a2087f6e3eeec91c002f66d4f9256e809439d2e081031e0776803e6c

General

Target

9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
Size

425KB
MD5

9f1a5e5c6a5c5493459010d43af8f504
SHA1

56ed32addbac6dd6f1fe2ddfb4add70c04a1596d
SHA256

652ed909a2087f6e3eeec91c002f66d4f9256e809439d2e081031e0776803e6c
SHA512

5a2b2077abb729fd4f186a81e6941b04dc59c7b1a4173ffd1db8aea4c9d9e7a628958ff577bc46b85cba3ca597642c766c85f83670bc1fc5345616930baa3fe1
SSDEEP

12288:wHFZ2iNHv2zv1gt1jnqgS7+QkNdlVR81TasQw8Mgy:41c2tpnc7Md/R893V8Mgy

Score

10^/10

xloader pzba loader rat

Malware Config

Extracted

Family

xloader

Version

2.1

Campaign

pzba

Decoy

cafeblanca.net

goodvibrationswindchimes.com

mydmapp.com

isabelpasadaspsicologa.com

adonustmuseum.com

oghomeinfoa18.club

asia-ivoyage.com

chargegamehair.com

78500802.xyz

siteoficialcliqueagora.com

kanchanspice.com

elysalesgh.com

zbarrier.com

mariedietze.fyi

ppope.com

bluechipsgroup.company

mineola.education

covkpbac.icu

bettercityhomes.com

elevenlevels.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2868-16-0x0000000000400000-0x0000000000428000-memory.dmp xloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe

description pid process target process

PID 2240 set thread context of 2868 2240 9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe 9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe

pid process

2240 9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
2868 9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2240 9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2868-16-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

description	pid	process	target process
PID 2240 set thread context of 2868	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe

pid	process
2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
2868	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe

description	pid	process	target process
PID 2240 wrote to memory of 2532	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
PID 2240 wrote to memory of 2532	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
PID 2240 wrote to memory of 2532	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
PID 2240 wrote to memory of 2532	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
PID 2240 wrote to memory of 2868	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
PID 2240 wrote to memory of 2868	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
PID 2240 wrote to memory of 2868	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
PID 2240 wrote to memory of 2868	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
PID 2240 wrote to memory of 2868	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
PID 2240 wrote to memory of 2868	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
PID 2240 wrote to memory of 2868	2240	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe	9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240

C:\Users\Admin\AppData\Local\Temp\9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe"
2⤵
PID:2532

C:\Users\Admin\AppData\Local\Temp\9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f1a5e5c6a5c5493459010d43af8f504_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-6-0x0000000004BF0000-0x0000000004C40000-memory.dmp

Filesize
320KB

Download
memory/2240-8-0x0000000000BE0000-0x0000000000C10000-memory.dmp

Filesize
192KB

Download
memory/2240-2-0x00000000004E0000-0x00000000004F8000-memory.dmp

Filesize
96KB

Download
memory/2240-3-0x0000000074540000-0x0000000074C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2240-4-0x000000007454E000-0x000000007454F000-memory.dmp

Filesize
4KB

Download
memory/2240-5-0x0000000074540000-0x0000000074C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2240-1-0x0000000001170000-0x00000000011E0000-memory.dmp

Filesize
448KB

Download
memory/2240-7-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2240-0-0x000000007454E000-0x000000007454F000-memory.dmp

Filesize
4KB

Download
memory/2240-17-0x0000000074540000-0x0000000074C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2868-16-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2868-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2868-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2868-18-0x0000000000950000-0x0000000000C53000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing