Analysis
-
max time kernel
112s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
09-06-2022 10:54
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.8546.exe
Resource
win7-20220414-en
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.8546.exe
-
Size
724KB
-
MD5
1b053ad5898e7a62a5ba6d5b4614acc1
-
SHA1
24ec1578605b09fd3da9aef8613358bfbb205398
-
SHA256
577322e3f941bd8f432e83818ff0e97f411e67e75f9ed5654b856f6e6e2ae9e2
-
SHA512
f3641c3bcaa88ac62305bec4d42f37ee1455f5979f2f9c6525cc2d183be58dca91fa222d03da5b8d007993750187b37f3980a465291f667d58f2a3626df46f93
Malware Config
Extracted
xloader
2.7
n5mz
ezhuilike.com
broomstickrum.com
ramaniclothing.com
midbots.com
rlxscpe.com
elanagro.online
chahuajie.com
digipubcity.com
predatorstoppers.com
savas-jewelry.com
timinis23.com
homesteaddesignstudio.net
bellezadehoy.online
disintar.xyz
sharinks.tech
redfoxdetroit.com
resscoptheron.com
aspiritualgiftshoppe.com
tematemazo.com
assasa.net
rogfinance.info
ms7779.com
100shortvideos.com
funandfoodboat.com
hubinvoice.com
geroofl.com
unitedoceanlogistics.com
vineabank.com
manchimaata.com
comproorohuelva.com
schooledwriters.com
pastafrescabg.com
no-website-yet.com
waydiscount3.xyz
shroommhc.com
letbeautifyus.com
1869114763.xyz
gasurvivalgear.com
usdtsearch.com
bluewavewoodrow.com
shumeldavisual.com
onlinedegreesukr.com
iden3s.com
kathhyhenslee.com
norskeplanteskoler.online
fullsexzone.net
ssq0973.com
hayatcevredanismanlik.com
pageone.life
takeka.com
karbies.com
augustamobilenotary.net
equipoheza.com
thewoodlandsmusiclessons.com
albemale.com
chaobomedia.com
hg06809.com
icarus-soft.com
duckholland.com
profoxwebdesigner.online
admoola.com
ds922.com
antipeek.net
fanjingdesigner.com
sinibelanja.website
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4964-144-0x0000000000400000-0x000000000042B000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8546.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.W32.AIDetectNet.01.8546.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8546.exedescription pid process target process PID 4236 set thread context of 4964 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeSecuriteInfo.com.W32.AIDetectNet.01.8546.exepid process 2600 powershell.exe 2600 powershell.exe 4964 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe 4964 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2600 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8546.exedescription pid process target process PID 4236 wrote to memory of 2600 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe powershell.exe PID 4236 wrote to memory of 2600 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe powershell.exe PID 4236 wrote to memory of 2600 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe powershell.exe PID 4236 wrote to memory of 3552 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe schtasks.exe PID 4236 wrote to memory of 3552 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe schtasks.exe PID 4236 wrote to memory of 3552 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe schtasks.exe PID 4236 wrote to memory of 4964 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe PID 4236 wrote to memory of 4964 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe PID 4236 wrote to memory of 4964 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe PID 4236 wrote to memory of 4964 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe PID 4236 wrote to memory of 4964 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe PID 4236 wrote to memory of 4964 4236 SecuriteInfo.com.W32.AIDetectNet.01.8546.exe SecuriteInfo.com.W32.AIDetectNet.01.8546.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WoJYlIWNwLUW.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WoJYlIWNwLUW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5D91.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5D91.tmpFilesize
1KB
MD558297850ece7e1d6ae94702a2178a089
SHA15c0f8b475b43261a478159c1a70098baef14e894
SHA256e78544ce01f8a3d2498e8fcd7691bf562f5e26315d031a97bae5fc3f5605fff5
SHA5122ea66a6f6f04620fe80a47e0d86c98c068ce15310c9ed9e490be566b21ca7435dad9c8ddb3ca1b575287af41e3fb0bb0075c906d3ed178534734350107335f05
-
memory/2600-142-0x00000000056C0000-0x0000000005726000-memory.dmpFilesize
408KB
-
memory/2600-150-0x0000000007710000-0x0000000007D8A000-memory.dmpFilesize
6.5MB
-
memory/2600-155-0x0000000007400000-0x000000000741A000-memory.dmpFilesize
104KB
-
memory/2600-145-0x0000000005DC0000-0x0000000005DDE000-memory.dmpFilesize
120KB
-
memory/2600-154-0x00000000072F0000-0x00000000072FE000-memory.dmpFilesize
56KB
-
memory/2600-136-0x0000000000000000-mapping.dmp
-
memory/2600-153-0x0000000007340000-0x00000000073D6000-memory.dmpFilesize
600KB
-
memory/2600-138-0x0000000002490000-0x00000000024C6000-memory.dmpFilesize
216KB
-
memory/2600-152-0x0000000007140000-0x000000000714A000-memory.dmpFilesize
40KB
-
memory/2600-140-0x0000000004F60000-0x0000000005588000-memory.dmpFilesize
6.2MB
-
memory/2600-141-0x0000000004EE0000-0x0000000004F02000-memory.dmpFilesize
136KB
-
memory/2600-151-0x00000000070C0000-0x00000000070DA000-memory.dmpFilesize
104KB
-
memory/2600-156-0x00000000073E0000-0x00000000073E8000-memory.dmpFilesize
32KB
-
memory/2600-149-0x0000000006360000-0x000000000637E000-memory.dmpFilesize
120KB
-
memory/2600-148-0x0000000074E10000-0x0000000074E5C000-memory.dmpFilesize
304KB
-
memory/2600-147-0x00000000063A0000-0x00000000063D2000-memory.dmpFilesize
200KB
-
memory/3552-137-0x0000000000000000-mapping.dmp
-
memory/4236-134-0x0000000007E80000-0x0000000007F1C000-memory.dmpFilesize
624KB
-
memory/4236-133-0x0000000005A90000-0x0000000005A9A000-memory.dmpFilesize
40KB
-
memory/4236-132-0x00000000058F0000-0x0000000005982000-memory.dmpFilesize
584KB
-
memory/4236-130-0x0000000000EA0000-0x0000000000F5C000-memory.dmpFilesize
752KB
-
memory/4236-131-0x0000000005DC0000-0x0000000006364000-memory.dmpFilesize
5.6MB
-
memory/4236-135-0x00000000084E0000-0x0000000008546000-memory.dmpFilesize
408KB
-
memory/4964-146-0x0000000001060000-0x00000000013AA000-memory.dmpFilesize
3.3MB
-
memory/4964-144-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4964-143-0x0000000000000000-mapping.dmp