Overview

overview

10

Static

static

SecuriteIn...22.exe

windows7_x64

10

SecuriteIn...22.exe

windows10_x64

10

Analysis

  • max time kernel
    57s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    23/08/2021, 21:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Trojan.PackedNET.999.22645.5322.exe
  • Size 837KB
  • Sample210823-srnbbgl23x
  • SHA256 52aaa20eef4d75bb209ef1d632a3e5a894358ebbd5ae9e18262868209fa30b7c
  • MD5 SHA1 SHA512
Score
10/10
xloaderb6culoaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • b6cu

C2

  • http://www.xn--marketingrevolucin-61b.com/b6cu/

Decoy

  • votreconseilfinancier.com

  • wholesaleplay.com

  • komfy.store

  • hsyunfan.com

  • tournamenttips.com

  • yourbusine.xyz

  • wrg-referrals.com

  • harmless-oily.com

  • whizdomtowealth.com

  • xusmods.com

  • cleanerstoday.com

  • finopscert.com

  • paerexpress.com

  • kankb.com

  • res-o.info

  • balonpantolon.com

  • freedownloadbiz.info

  • jeffegriffin.com

  • gobahis119.com

  • ourcalvinsarm.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.999.22645.5322.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.999.22645.5322.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WKLAxsZo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp326B.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3956
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.999.22645.5322.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.999.22645.5322.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4180

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/4180-118-0x0000000000400000-0x0000000000429000-memory.dmp
        Download

        memory/4180-120-0x00000000010A0000-0x00000000013C0000-memory.dmp
        Download

        memory/4648-114-0x0000000002500000-0x0000000002501000-memory.dmp
        Download

        memory/4648-115-0x0000000002501000-0x0000000002502000-memory.dmp
        Download