Analysis
- max time kernel
14s - max time network
113s - platform
windows10_x64 - resource
win10v20210408 - submitted
12/04/2021, 13:46
General
- Target SecuriteInfo.com.W32.AIDetect.malware1.17659.21832.exe
- Size 364KB
- Sample210412-2h85351wee
- SHA256 f36d0fe551b2be41e023f6a55d35ffb3ae7a5e021703c4b49235e04e296aceb3
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.3
C2
-
http://www.scott-re.online/nnmd/
Decoy
-
bongwater.life
-
regalparkllc.com
-
gyanankuram.com
-
quehaydecenarhoy.com
-
israeldigitalblog.net
-
gatewaygaurdians.com
-
krphp.com
-
domentemenegi47.com
-
fjsibao.com
-
yetbor.com
-
goldenvalueable.com
-
finalexam-thegame.com
-
buyeverythingforbaby.com
-
phillydroneservices.com
-
xn--kck4cd0r.net
-
suns-brothers.com
-
xn--80aaxkmix.xn--p1acf
-
pjsgsc.com
-
7985699.com
-
blackmantech.fitness
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.17659.21832.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.17659.21832.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.17659.21832.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.17659.21832.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/784-116-0x0000000003F20000-0x0000000003F4A000-memory.dmp
memory/2464-114-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2464-118-0x0000000000B60000-0x0000000000E80000-memory.dmp