Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
31-05-2022 11:46
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.8006.exe
-
Size
1.4MB
-
MD5
57138eb4381bfad492ff92f212cb26a6
-
SHA1
8f579ae5f1809587bb91a01a43288e827f542afc
-
SHA256
174f8ae3d2b924f845a9d1708dbb9dc3e219b21252b14cdcf8c253f2900c7d4f
-
SHA512
10157223dff8f08946f14832e70b31d30954417278c91e7c4d7f57e1a7c4599573a51fe25b747ab5571fe56dec04d30c1b07fcc79466aa28512c377ba6253805
Malware Config
Extracted
xloader
2.6
a8hq
veteransductcleaning.com
beajtjunkies.com
houseofascofi.com
scottsdalemediator.com
atelyadesign.com
profitcase.pro
imtokenio.club
qinglingpai.com
bigsmile-meal.net
daytonlivestream.com
aspiradores10.online
ytybs120.com
hdatelier.com
bearpierce.com
yeson28ca.com
booklearner.com
m8j9.club
mmophamthinhlegend.space
hq4a7o6zb.com
sophiadaki.online
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8006.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8006.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8006.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1724-75-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1724-81-0x0000000000C50000-0x0000000000F53000-memory.dmpFilesize
3.0MB
-
memory/1724-72-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1724-73-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1724-76-0x000000000041F2C0-mapping.dmp
-
memory/1836-68-0x00000000708C0000-0x00000000715DD000-memory.dmpFilesize
13.1MB
-
memory/1836-70-0x0000000005370000-0x00000000053F4000-memory.dmpFilesize
528KB
-
memory/1836-61-0x0000000073C10000-0x0000000073DE1000-memory.dmpFilesize
1.8MB
-
memory/1836-62-0x0000000073AF0000-0x0000000073BEC000-memory.dmpFilesize
1008KB
-
memory/1836-63-0x000000006F9A0000-0x00000000700DE000-memory.dmpFilesize
7.2MB
-
memory/1836-64-0x0000000000380000-0x000000000038A000-memory.dmpFilesize
40KB
-
memory/1836-65-0x0000000071FF0000-0x000000007337F000-memory.dmpFilesize
19.6MB
-
memory/1836-66-0x00000000715E0000-0x0000000071FF0000-memory.dmpFilesize
10.1MB
-
memory/1836-67-0x0000000073DF0000-0x0000000073F84000-memory.dmpFilesize
1.6MB
-
memory/1836-54-0x0000000000860000-0x00000000009CC000-memory.dmpFilesize
1.4MB
-
memory/1836-69-0x0000000073C10000-0x0000000073DE1000-memory.dmpFilesize
1.8MB
-
memory/1836-60-0x00000000700E0000-0x00000000708C0000-memory.dmpFilesize
7.9MB
-
memory/1836-71-0x0000000000550000-0x0000000000582000-memory.dmpFilesize
200KB
-
memory/1836-59-0x00000000708C0000-0x00000000715DD000-memory.dmpFilesize
13.1MB
-
memory/1836-58-0x0000000073DF0000-0x0000000073F84000-memory.dmpFilesize
1.6MB
-
memory/1836-57-0x00000000715E0000-0x0000000071FF0000-memory.dmpFilesize
10.1MB
-
memory/1836-77-0x0000000071FF0000-0x000000007337F000-memory.dmpFilesize
19.6MB
-
memory/1836-56-0x0000000071FF0000-0x000000007337F000-memory.dmpFilesize
19.6MB
-
memory/1836-79-0x0000000073DF0000-0x0000000073F84000-memory.dmpFilesize
1.6MB
-
memory/1836-55-0x0000000075501000-0x0000000075503000-memory.dmpFilesize
8KB
-
memory/1836-82-0x0000000073C10000-0x0000000073DE1000-memory.dmpFilesize
1.8MB
-
memory/1836-80-0x00000000708C0000-0x00000000715DD000-memory.dmpFilesize
13.1MB
-
memory/1836-78-0x00000000715E0000-0x0000000071FF0000-memory.dmpFilesize
10.1MB