Analysis

  • max time kernel
    112s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    09-06-2022 10:54

General

  • Target

    SecuriteInfo.com.W32.AIDetectNet.01.8546.exe

  • Size

    724KB

  • MD5

    1b053ad5898e7a62a5ba6d5b4614acc1

  • SHA1

    24ec1578605b09fd3da9aef8613358bfbb205398

  • SHA256

    577322e3f941bd8f432e83818ff0e97f411e67e75f9ed5654b856f6e6e2ae9e2

  • SHA512

    f3641c3bcaa88ac62305bec4d42f37ee1455f5979f2f9c6525cc2d183be58dca91fa222d03da5b8d007993750187b37f3980a465291f667d58f2a3626df46f93

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.7

Campaign

n5mz

Decoy

ezhuilike.com

broomstickrum.com

ramaniclothing.com

midbots.com

rlxscpe.com

elanagro.online

chahuajie.com

digipubcity.com

predatorstoppers.com

savas-jewelry.com

timinis23.com

homesteaddesignstudio.net

bellezadehoy.online

disintar.xyz

sharinks.tech

redfoxdetroit.com

resscoptheron.com

aspiritualgiftshoppe.com

tematemazo.com

assasa.net

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WoJYlIWNwLUW.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2600
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WoJYlIWNwLUW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5D91.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3552
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8546.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4964

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp5D91.tmp
    Filesize

    1KB

    MD5

    58297850ece7e1d6ae94702a2178a089

    SHA1

    5c0f8b475b43261a478159c1a70098baef14e894

    SHA256

    e78544ce01f8a3d2498e8fcd7691bf562f5e26315d031a97bae5fc3f5605fff5

    SHA512

    2ea66a6f6f04620fe80a47e0d86c98c068ce15310c9ed9e490be566b21ca7435dad9c8ddb3ca1b575287af41e3fb0bb0075c906d3ed178534734350107335f05

  • memory/2600-142-0x00000000056C0000-0x0000000005726000-memory.dmp
    Filesize

    408KB

  • memory/2600-150-0x0000000007710000-0x0000000007D8A000-memory.dmp
    Filesize

    6.5MB

  • memory/2600-155-0x0000000007400000-0x000000000741A000-memory.dmp
    Filesize

    104KB

  • memory/2600-145-0x0000000005DC0000-0x0000000005DDE000-memory.dmp
    Filesize

    120KB

  • memory/2600-154-0x00000000072F0000-0x00000000072FE000-memory.dmp
    Filesize

    56KB

  • memory/2600-136-0x0000000000000000-mapping.dmp
  • memory/2600-153-0x0000000007340000-0x00000000073D6000-memory.dmp
    Filesize

    600KB

  • memory/2600-138-0x0000000002490000-0x00000000024C6000-memory.dmp
    Filesize

    216KB

  • memory/2600-152-0x0000000007140000-0x000000000714A000-memory.dmp
    Filesize

    40KB

  • memory/2600-140-0x0000000004F60000-0x0000000005588000-memory.dmp
    Filesize

    6.2MB

  • memory/2600-141-0x0000000004EE0000-0x0000000004F02000-memory.dmp
    Filesize

    136KB

  • memory/2600-151-0x00000000070C0000-0x00000000070DA000-memory.dmp
    Filesize

    104KB

  • memory/2600-156-0x00000000073E0000-0x00000000073E8000-memory.dmp
    Filesize

    32KB

  • memory/2600-149-0x0000000006360000-0x000000000637E000-memory.dmp
    Filesize

    120KB

  • memory/2600-148-0x0000000074E10000-0x0000000074E5C000-memory.dmp
    Filesize

    304KB

  • memory/2600-147-0x00000000063A0000-0x00000000063D2000-memory.dmp
    Filesize

    200KB

  • memory/3552-137-0x0000000000000000-mapping.dmp
  • memory/4236-134-0x0000000007E80000-0x0000000007F1C000-memory.dmp
    Filesize

    624KB

  • memory/4236-133-0x0000000005A90000-0x0000000005A9A000-memory.dmp
    Filesize

    40KB

  • memory/4236-132-0x00000000058F0000-0x0000000005982000-memory.dmp
    Filesize

    584KB

  • memory/4236-130-0x0000000000EA0000-0x0000000000F5C000-memory.dmp
    Filesize

    752KB

  • memory/4236-131-0x0000000005DC0000-0x0000000006364000-memory.dmp
    Filesize

    5.6MB

  • memory/4236-135-0x00000000084E0000-0x0000000008546000-memory.dmp
    Filesize

    408KB

  • memory/4964-146-0x0000000001060000-0x00000000013AA000-memory.dmp
    Filesize

    3.3MB

  • memory/4964-144-0x0000000000400000-0x000000000042B000-memory.dmp
    Filesize

    172KB

  • memory/4964-143-0x0000000000000000-mapping.dmp