Analysis
-
max time kernel
45s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-06-2022 03:30
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.17459.exe
-
Size
762KB
-
MD5
9ff3dfbce0e1b746772ae35dfa21e50d
-
SHA1
dc785bcab9218eee918ecdb7ee84be0ff4e1acf9
-
SHA256
b053714ce58eb3396c7b51a3b5c0dea99c92e71b3da65e4de1ea640f6ad4d82d
-
SHA512
447de05f128e840352f7c3b4545356576cdbc335775c2af233c07c94833ac816438c4d5e454c68f1ea13329fefce71a311a04d773a8fc658e7def2fbadb39f7f
Malware Config
Extracted
xloader
2.6
a8hq
veteransductcleaning.com
beajtjunkies.com
houseofascofi.com
scottsdalemediator.com
atelyadesign.com
profitcase.pro
imtokenio.club
qinglingpai.com
bigsmile-meal.net
daytonlivestream.com
aspiradores10.online
ytybs120.com
hdatelier.com
bearpierce.com
yeson28ca.com
booklearner.com
m8j9.club
mmophamthinhlegend.space
hq4a7o6zb.com
sophiadaki.online
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.17459.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.17459.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.17459.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/976-66-0x0000000071C90000-0x00000000726A0000-memory.dmpFilesize
10.1MB
-
memory/976-81-0x0000000074030000-0x0000000074201000-memory.dmpFilesize
1.8MB
-
memory/976-54-0x0000000000E10000-0x0000000000ED4000-memory.dmpFilesize
784KB
-
memory/976-57-0x0000000071C90000-0x00000000726A0000-memory.dmpFilesize
10.1MB
-
memory/976-58-0x0000000074210000-0x00000000743A4000-memory.dmpFilesize
1.6MB
-
memory/976-59-0x0000000070F70000-0x0000000071C8D000-memory.dmpFilesize
13.1MB
-
memory/976-60-0x00000000003D0000-0x00000000003DA000-memory.dmpFilesize
40KB
-
memory/976-61-0x0000000070790000-0x0000000070F70000-memory.dmpFilesize
7.9MB
-
memory/976-62-0x0000000074030000-0x0000000074201000-memory.dmpFilesize
1.8MB
-
memory/976-63-0x0000000073F30000-0x000000007402C000-memory.dmpFilesize
1008KB
-
memory/976-64-0x0000000070050000-0x000000007078E000-memory.dmpFilesize
7.2MB
-
memory/976-65-0x00000000726A0000-0x0000000073A2F000-memory.dmpFilesize
19.6MB
-
memory/976-56-0x00000000726A0000-0x0000000073A2F000-memory.dmpFilesize
19.6MB
-
memory/976-55-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB
-
memory/976-76-0x00000000726A0000-0x0000000073A2F000-memory.dmpFilesize
19.6MB
-
memory/976-69-0x0000000005880000-0x0000000005904000-memory.dmpFilesize
528KB
-
memory/976-70-0x0000000000B10000-0x0000000000B42000-memory.dmpFilesize
200KB
-
memory/976-67-0x0000000074210000-0x00000000743A4000-memory.dmpFilesize
1.6MB
-
memory/976-80-0x0000000070F70000-0x0000000071C8D000-memory.dmpFilesize
13.1MB
-
memory/976-78-0x0000000074210000-0x00000000743A4000-memory.dmpFilesize
1.6MB
-
memory/976-77-0x0000000071C90000-0x00000000726A0000-memory.dmpFilesize
10.1MB
-
memory/976-68-0x0000000070F70000-0x0000000071C8D000-memory.dmpFilesize
13.1MB
-
memory/1780-75-0x000000000041F2C0-mapping.dmp
-
memory/1780-74-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1780-79-0x0000000000A60000-0x0000000000D63000-memory.dmpFilesize
3.0MB
-
memory/1780-72-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1780-71-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB