Analysis
- max time kernel
45s - max time network
48s - platform
windows7_x64 - resource
win7-20220414-en - submitted
02/06/2022, 03:30
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.17459.exe
- Size 762KB
- Sample220602-d2gp8adaa2
- SHA256 b053714ce58eb3396c7b51a3b5c0dea99c92e71b3da65e4de1ea640f6ad4d82d
Malware Config
Extracted
-
xloader
-
2.6
-
a8hq
-
veteransductcleaning.com
-
beajtjunkies.com
-
houseofascofi.com
-
scottsdalemediator.com
-
atelyadesign.com
-
profitcase.pro
-
imtokenio.club
-
qinglingpai.com
-
bigsmile-meal.net
-
daytonlivestream.com
-
aspiradores10.online
-
ytybs120.com
-
hdatelier.com
-
bearpierce.com
-
yeson28ca.com
-
booklearner.com
-
m8j9.club
-
mmophamthinhlegend.space
-
hq4a7o6zb.com
-
sophiadaki.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.17459.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.17459.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.17459.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/976-66-0x0000000071C90000-0x00000000726A0000-memory.dmp
memory/976-68-0x0000000070F70000-0x0000000071C8D000-memory.dmp
memory/976-56-0x00000000726A0000-0x0000000073A2F000-memory.dmp
memory/976-57-0x0000000071C90000-0x00000000726A0000-memory.dmp
memory/976-58-0x0000000074210000-0x00000000743A4000-memory.dmp
memory/976-59-0x0000000070F70000-0x0000000071C8D000-memory.dmp
memory/976-60-0x00000000003D0000-0x00000000003DA000-memory.dmp
memory/976-61-0x0000000070790000-0x0000000070F70000-memory.dmp
memory/976-62-0x0000000074030000-0x0000000074201000-memory.dmp
memory/976-63-0x0000000073F30000-0x000000007402C000-memory.dmp
memory/976-64-0x0000000070050000-0x000000007078E000-memory.dmp
memory/976-77-0x0000000071C90000-0x00000000726A0000-memory.dmp
memory/976-55-0x00000000752D1000-0x00000000752D3000-memory.dmp
memory/976-54-0x0000000000E10000-0x0000000000ED4000-memory.dmp
memory/976-65-0x00000000726A0000-0x0000000073A2F000-memory.dmp
memory/976-69-0x0000000005880000-0x0000000005904000-memory.dmp
memory/976-70-0x0000000000B10000-0x0000000000B42000-memory.dmp
memory/976-81-0x0000000074030000-0x0000000074201000-memory.dmp
memory/976-80-0x0000000070F70000-0x0000000071C8D000-memory.dmp
memory/976-67-0x0000000074210000-0x00000000743A4000-memory.dmp
memory/976-78-0x0000000074210000-0x00000000743A4000-memory.dmp
memory/976-76-0x00000000726A0000-0x0000000073A2F000-memory.dmp
memory/1780-79-0x0000000000A60000-0x0000000000D63000-memory.dmp
memory/1780-74-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1780-72-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1780-71-0x0000000000400000-0x000000000042B000-memory.dmp