Overview

overview

10

Static

static

SecuriteIn...12.exe

windows7_x64

10

SecuriteIn...12.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    91s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    06/06/2022, 10:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Trojan.PackedNET.1367.10412.exe
  • Size 622KB
  • Sample220606-mydzlabham
  • SHA256 fc753d6a1adb745147ae129b7745f4d5bdb7c02fcad71e96bb40b305ca0b45b8
  • MD5 SHA1 SHA512
Score
10/10
xloadertdhtloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • tdht

Decoy

  • marcosmc.com

  • theknicksfix.com

  • skjgjs.com

  • blacktuxs.com

  • monanimaldecompanie.com

  • initiummallsquare.com

  • bleekvandaag.online

  • ultimatestoragelimited.com

  • caobatins.com

  • sun-mirror.ink

  • eclbet.download

  • kiewitus.com

  • mtgeezer.com

  • sar-partners.com

  • aedregistrations.com

  • hpsebz.online

  • akaxai.com

  • endtoendengineering.com

  • sorayadossantos.com

  • lj2d6dd39.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 1 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1367.10412.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1367.10412.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1367.10412.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1367.10412.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:752

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/752-137-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/752-138-0x0000000001460000-0x00000000017AA000-memory.dmp
        Download

        memory/2444-130-0x0000000000200000-0x00000000002A2000-memory.dmp
        Download

        memory/2444-131-0x0000000005130000-0x00000000056D4000-memory.dmp
        Download

        memory/2444-132-0x0000000004C60000-0x0000000004CF2000-memory.dmp
        Download

        memory/2444-133-0x0000000004DF0000-0x0000000004DFA000-memory.dmp
        Download

        memory/2444-134-0x0000000007410000-0x00000000074AC000-memory.dmp
        Download

        memory/2444-135-0x0000000007740000-0x00000000077A6000-memory.dmp
        Download