Analysis
-
max time kernel
49s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
09-06-2022 10:54
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.8546.exe
Resource
win7-20220414-en
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.8546.exe
-
Size
724KB
-
MD5
1b053ad5898e7a62a5ba6d5b4614acc1
-
SHA1
24ec1578605b09fd3da9aef8613358bfbb205398
-
SHA256
577322e3f941bd8f432e83818ff0e97f411e67e75f9ed5654b856f6e6e2ae9e2
-
SHA512
f3641c3bcaa88ac62305bec4d42f37ee1455f5979f2f9c6525cc2d183be58dca91fa222d03da5b8d007993750187b37f3980a465291f667d58f2a3626df46f93
Malware Config
Extracted
xloader
2.7
n5mz
ezhuilike.com
broomstickrum.com
ramaniclothing.com
midbots.com
rlxscpe.com
elanagro.online
chahuajie.com
digipubcity.com
predatorstoppers.com
savas-jewelry.com
timinis23.com
homesteaddesignstudio.net
bellezadehoy.online
disintar.xyz
sharinks.tech
redfoxdetroit.com
resscoptheron.com
aspiritualgiftshoppe.com
tematemazo.com
assasa.net
rogfinance.info
ms7779.com
100shortvideos.com
funandfoodboat.com
hubinvoice.com
geroofl.com
unitedoceanlogistics.com
vineabank.com
manchimaata.com
comproorohuelva.com
schooledwriters.com
pastafrescabg.com
no-website-yet.com
waydiscount3.xyz
shroommhc.com
letbeautifyus.com
1869114763.xyz
gasurvivalgear.com
usdtsearch.com
bluewavewoodrow.com
shumeldavisual.com
onlinedegreesukr.com
iden3s.com
kathhyhenslee.com
norskeplanteskoler.online
fullsexzone.net
ssq0973.com
hayatcevredanismanlik.com
pageone.life
takeka.com
karbies.com
augustamobilenotary.net
equipoheza.com
thewoodlandsmusiclessons.com
albemale.com
chaobomedia.com
hg06809.com
icarus-soft.com
duckholland.com
profoxwebdesigner.online
admoola.com
ds922.com
antipeek.net
fanjingdesigner.com
sinibelanja.website
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1720-67-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1720-68-0x000000000041F330-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8546.exedescription pid process target process PID 1600 set thread context of 1720 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exeSecuriteInfo.com.W32.AIDetectNet.01.8546.exepid process 2016 powershell.exe 1720 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2016 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8546.exedescription pid process target process PID 1600 wrote to memory of 2016 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe powershell.exe PID 1600 wrote to memory of 2016 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe powershell.exe PID 1600 wrote to memory of 2016 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe powershell.exe PID 1600 wrote to memory of 2016 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe powershell.exe PID 1600 wrote to memory of 2000 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe schtasks.exe PID 1600 wrote to memory of 2000 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe schtasks.exe PID 1600 wrote to memory of 2000 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe schtasks.exe PID 1600 wrote to memory of 2000 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe schtasks.exe PID 1600 wrote to memory of 1720 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe PID 1600 wrote to memory of 1720 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe PID 1600 wrote to memory of 1720 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe PID 1600 wrote to memory of 1720 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe PID 1600 wrote to memory of 1720 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe PID 1600 wrote to memory of 1720 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe PID 1600 wrote to memory of 1720 1600 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WoJYlIWNwLUW.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WoJYlIWNwLUW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAFE0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAFE0.tmpFilesize
1KB
MD5161a7ee87f983893612cb58f619543cc
SHA12e17e80cdf1dabd5d1dec8164b4e94cb9940237e
SHA2567c6d3420b60cf7daec6280a7479d7cadbb29a6177fc8b8da7181b0d316e1dd7d
SHA512f59f14df0305e23f66c179a1094b88e8a7866b91a37cee6872a1e8063aed221c0acaaa5cfee643b21cf8eff23197c2289dee562ed8d2b1634eed939c65461021
-
memory/1600-62-0x0000000002170000-0x0000000002176000-memory.dmpFilesize
24KB
-
memory/1600-55-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/1600-56-0x0000000000460000-0x0000000000472000-memory.dmpFilesize
72KB
-
memory/1600-57-0x00000000057C0000-0x000000000584E000-memory.dmpFilesize
568KB
-
memory/1600-54-0x0000000000980000-0x0000000000A3C000-memory.dmpFilesize
752KB
-
memory/1600-63-0x0000000004750000-0x0000000004782000-memory.dmpFilesize
200KB
-
memory/1720-68-0x000000000041F330-mapping.dmp
-
memory/1720-64-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1720-65-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1720-67-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1720-69-0x0000000000A40000-0x0000000000D43000-memory.dmpFilesize
3.0MB
-
memory/2000-59-0x0000000000000000-mapping.dmp
-
memory/2016-58-0x0000000000000000-mapping.dmp
-
memory/2016-70-0x000000006EB70000-0x000000006F11B000-memory.dmpFilesize
5.7MB
-
memory/2016-71-0x000000006EB70000-0x000000006F11B000-memory.dmpFilesize
5.7MB