Analysis
- max time kernel
94s - max time network
43s - platform
windows7_x64 - resource
win7-20220414-en - submitted
13/06/2022, 16:50
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.16119.exe
- Size 449KB
- Sample220613-vb9fzshddm
- SHA256 9384b3c5ba07e22c69a0a681cb14f98e2f8d0274858e2ad12371d000c844ab4a
Malware Config
Extracted
-
xloader
-
2.6
-
oecd
-
mrcrickethighlights.com
-
milozzo.com
-
biggorillacreative.com
-
pecwi67.store
-
stoneeast.com
-
redicredi.com
-
warrentonvalodging.com
-
lexbbc.com
-
acmet-shirtco.com
-
grocits.com
-
vlconstruction.info
-
jxstore1.com
-
lifeenrollmarketplace.com
-
wgr5n.xyz
-
710wgm.com
-
ccrdidkqpoxzrrpfpmcb.com
-
boswellbrothersofnc.net
-
girajewelry.com
-
primesukkah.com
-
daotengge.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.16119.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.16119.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.16119.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.16119.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/948-54-0x00000000000B0000-0x0000000000126000-memory.dmp
memory/948-55-0x0000000074F21000-0x0000000074F23000-memory.dmp
memory/948-56-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/948-57-0x0000000005D40000-0x0000000005DAA000-memory.dmp
memory/948-58-0x0000000004370000-0x00000000043A2000-memory.dmp
memory/1804-59-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1804-60-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1804-62-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1804-64-0x00000000009E0000-0x0000000000CE3000-memory.dmp