Overview

overview

10

Static

static

SecuriteIn...18.exe

windows7_x64

10

SecuriteIn...18.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    77s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    13/06/2022, 05:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
  • Size 453KB
  • Sample220613-gcvsbsabe7
  • SHA256 dcfa4dfcc90ae3c90deb36709bdaed5a1d49a174139bf814cd758ed8b6859c1a
  • MD5 SHA1 SHA512
Score
10/10
xloaderbe3sloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • be3s

Decoy

  • aoxaswa.info

  • souplab-graphic.com

  • churchontheisland.com

  • spclassic-cars.com

  • stanford-edu.club

  • heydowm.online

  • chattanooga-electricians.com

  • sectsk.com

  • cxg98.com

  • buildafricaonline.net

  • buydogcoin.com

  • vsst247.com

  • lodgelastrancas.com

  • ainonaho.com

  • griousndwarehsftyfs.xyz

  • voltagestabilizersupply.com

  • xn--79q565dzfex9hg81b.com

  • isrvr-ccrforum.info

  • chitiandi.com

  • criticaldisco.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4418.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4418.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:956

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/956-62-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/956-60-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/956-59-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/956-64-0x0000000000AA0000-0x0000000000DA3000-memory.dmp
        Download

        memory/1904-54-0x0000000000A20000-0x0000000000A96000-memory.dmp
        Download

        memory/1904-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp
        Download

        memory/1904-56-0x00000000003F0000-0x00000000003FE000-memory.dmp
        Download

        memory/1904-57-0x00000000054B0000-0x000000000551A000-memory.dmp
        Download

        memory/1904-58-0x0000000000650000-0x0000000000682000-memory.dmp
        Download