Overview

overview

10

Static

static

SecuriteIn...13.exe

windows7_x64

10

SecuriteIn...13.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    72s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25/05/2022, 21:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.W32.AIDetectNet.01.1113.exe
  • Size 649KB
  • Sample220525-1fbneaddf2
  • SHA256 eebc2ceadb7e9541112a27a583603fd284208f1e2d23329c726efcfc02244609
  • MD5 SHA1 SHA512
Score
10/10
xloadertn61loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • tn61

Decoy

  • ryliehorrall.art

  • mesdco.net

  • street-art-ink.com

  • sepetcin.com

  • stilghar.com

  • hawaiipooltiles.com

  • fuerst-von-falkennest.com

  • totalvirtue.com

  • xdk0blc0tqy6a7.life

  • zootowngravel.com

  • kreditkarten-optionde.com

  • 6888tlbb.xyz

  • albertakleekai.com

  • travelnurseinfofinder3.life

  • valleyinnswat.com

  • secure-remove-devices.com

  • digitalswamy.com

  • www112casinova.com

  • medifasttrd.com

  • distritoxermar.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1113.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1113.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1113.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1113.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1796

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/948-54-0x0000000000330000-0x00000000003D8000-memory.dmp
        Download

        memory/948-55-0x0000000074F21000-0x0000000074F23000-memory.dmp
        Download

        memory/948-56-0x00000000002D0000-0x00000000002E6000-memory.dmp
        Download

        memory/948-57-0x00000000056D0000-0x0000000005766000-memory.dmp
        Download

        memory/948-58-0x0000000000850000-0x0000000000856000-memory.dmp
        Download

        memory/948-59-0x00000000020F0000-0x000000000212A000-memory.dmp
        Download

        memory/1796-60-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/1796-61-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/1796-63-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/1796-65-0x0000000000840000-0x0000000000B43000-memory.dmp
        Download