Overview

overview

10

Static

static

SecuriteIn...13.exe

windows7_x64

10

SecuriteIn...13.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    103s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25/05/2022, 21:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.W32.AIDetectNet.01.1113.exe
  • Size 649KB
  • Sample220525-1fbneaddf2
  • SHA256 eebc2ceadb7e9541112a27a583603fd284208f1e2d23329c726efcfc02244609
  • MD5 SHA1 SHA512
Score
10/10
xloadertn61loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • tn61

Decoy

  • ryliehorrall.art

  • mesdco.net

  • street-art-ink.com

  • sepetcin.com

  • stilghar.com

  • hawaiipooltiles.com

  • fuerst-von-falkennest.com

  • totalvirtue.com

  • xdk0blc0tqy6a7.life

  • zootowngravel.com

  • kreditkarten-optionde.com

  • 6888tlbb.xyz

  • albertakleekai.com

  • travelnurseinfofinder3.life

  • valleyinnswat.com

  • secure-remove-devices.com

  • digitalswamy.com

  • www112casinova.com

  • medifasttrd.com

  • distritoxermar.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 1 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1113.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1113.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3280
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1113.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1113.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:204

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/204-137-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/204-138-0x0000000001110000-0x000000000145A000-memory.dmp
        Download

        memory/3280-130-0x0000000000600000-0x00000000006A8000-memory.dmp
        Download

        memory/3280-131-0x00000000056A0000-0x0000000005C44000-memory.dmp
        Download

        memory/3280-132-0x0000000005030000-0x00000000050C2000-memory.dmp
        Download

        memory/3280-133-0x00000000051F0000-0x00000000051FA000-memory.dmp
        Download

        memory/3280-134-0x00000000077E0000-0x000000000787C000-memory.dmp
        Download

        memory/3280-135-0x0000000007C60000-0x0000000007CC6000-memory.dmp
        Download