Analysis
- max time kernel
90s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/05/2022, 11:58
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.6869.exe
- Size 656KB
- Sample220520-n456psbbh7
- SHA256 116440ea0c30932c6cdd9f67ef362006fb3785071e211ea5ac007bb18a540f8e
Malware Config
Extracted
-
xloader
-
2.6
-
a08h
-
hereogamer.com
-
viktorvojta.com
-
hanarokorea.com
-
breskizci.com
-
fixedopjobs.com
-
insidewomanmag.com
-
questrush.com
-
digitalmediaofnetworking.info
-
radixepge.com
-
hreheeh23.xyz
-
congregationsinai.online
-
kickt-spices.com
-
sodevweb.com
-
adsbookmark.com
-
blavktux.com
-
framedwallart.net
-
bites.center
-
evergreenpurdy.com
-
cashbuyerofdesmoines.com
-
gogovspend.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.6869.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.6869.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XuykOdqKsKXw.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XuykOdqKsKXw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBC3B.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.6869.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.6869.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.6869.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.6869.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmpBC3B.tmp
memory/812-151-0x0000000007980000-0x0000000007FFA000-memory.dmp
memory/812-155-0x0000000007520000-0x000000000752E000-memory.dmp
memory/812-157-0x0000000007610000-0x0000000007618000-memory.dmp
memory/812-156-0x0000000007630000-0x000000000764A000-memory.dmp
memory/812-144-0x0000000004E80000-0x0000000004EA2000-memory.dmp
memory/812-154-0x0000000007570000-0x0000000007606000-memory.dmp
memory/812-138-0x0000000000E60000-0x0000000000E96000-memory.dmp
memory/812-153-0x0000000007360000-0x000000000736A000-memory.dmp
memory/812-140-0x0000000005040000-0x0000000005668000-memory.dmp
memory/812-152-0x0000000007300000-0x000000000731A000-memory.dmp
memory/812-145-0x0000000005770000-0x00000000057D6000-memory.dmp
memory/812-150-0x0000000006580000-0x000000000659E000-memory.dmp
memory/812-149-0x00000000709D0000-0x0000000070A1C000-memory.dmp
memory/812-148-0x0000000006FD0000-0x0000000007002000-memory.dmp
memory/812-147-0x0000000005FE0000-0x0000000005FFE000-memory.dmp
memory/3176-132-0x0000000004CB0000-0x0000000004D42000-memory.dmp
memory/3176-130-0x0000000000250000-0x00000000002F4000-memory.dmp
memory/3176-131-0x00000000051C0000-0x0000000005764000-memory.dmp
memory/3176-135-0x0000000007890000-0x00000000078F6000-memory.dmp
memory/3176-134-0x0000000004FB0000-0x000000000504C000-memory.dmp
memory/3176-133-0x0000000004C90000-0x0000000004C9A000-memory.dmp
memory/4656-146-0x0000000001470000-0x00000000017BA000-memory.dmp
memory/4656-143-0x0000000000400000-0x000000000042B000-memory.dmp