Overview

overview

10

Static

static

SecuriteIn...63.exe

windows7_x64

10

SecuriteIn...63.exe

windows10_x64

10

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    04-11-2021 10:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Siggen15.34595.31963.19163.exe

  • Size

    528KB

  • MD5

    2b5dc0ab0d788a63f4a09f80c2de0799

  • SHA1

    25d10abffaa19611b1376d8e3bd1a541fdc6afed

  • SHA256

    8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f

  • SHA512

    7456bb3e5bee9626d7fa285c0112eb764327678f3f451b640d1f0de4fac46e6c0a0a8cf3f893a56ef5037fea8d8f4c78e85a0132edfca4a22b7e399705386311

Score
10/10
xloaderpufiloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pufi

C2

http://www.homestechs.com/pufi/

Decoy

fusiongroupgames.net

hugevari.com

rebeccagriffiths.com

trocaoferta.com

theslashapp.com

codezonesoftware.xyz

sottocommunications.com

minicreators.online

course2millions.com

hfm5n1dhkjqwpe.xyz

xlab-ub.com

silvanaribeirocake.com

thefabinteriordesign.com

mg-leadership.com

petbort.com

ndust.net

203040302.xyz

jakital.com

shophuunghia.info

rednacionaldejuecesrd.net

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen15.34595.31963.19163.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen15.34595.31963.19163.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen15.34595.31963.19163.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen15.34595.31963.19163.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/816-60-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

    Download
  • memory/816-61-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

    Download
  • memory/816-62-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

    Download
  • memory/816-63-0x000000000041D450-mapping.dmp
    Download
  • memory/816-64-0x0000000000A20000-0x0000000000D23000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/1648-54-0x0000000000990000-0x0000000000991000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1648-56-0x0000000076961000-0x0000000076963000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1648-57-0x00000000020F0000-0x00000000020F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1648-58-0x0000000000620000-0x0000000000626000-memory.dmp
    Filesize

    24KB

    Download
  • memory/1648-59-0x0000000002130000-0x000000000217C000-memory.dmp
    Filesize

    304KB

    Download