Analysis
- max time kernel
91s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
13/06/2022, 16:50
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.16119.exe
- Size 449KB
- Sample220613-vb9fzshddm
- SHA256 9384b3c5ba07e22c69a0a681cb14f98e2f8d0274858e2ad12371d000c844ab4a
Malware Config
Extracted
-
xloader
-
2.6
-
oecd
-
mrcrickethighlights.com
-
milozzo.com
-
biggorillacreative.com
-
pecwi67.store
-
stoneeast.com
-
redicredi.com
-
warrentonvalodging.com
-
lexbbc.com
-
acmet-shirtco.com
-
grocits.com
-
vlconstruction.info
-
jxstore1.com
-
lifeenrollmarketplace.com
-
wgr5n.xyz
-
710wgm.com
-
ccrdidkqpoxzrrpfpmcb.com
-
boswellbrothersofnc.net
-
girajewelry.com
-
primesukkah.com
-
daotengge.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.16119.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.16119.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.16119.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.16119.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3316-130-0x0000000000220000-0x0000000000296000-memory.dmp
memory/3316-131-0x0000000005080000-0x0000000005624000-memory.dmp
memory/3316-132-0x0000000004B70000-0x0000000004C02000-memory.dmp
memory/3316-133-0x0000000004B10000-0x0000000004B1A000-memory.dmp
memory/3316-134-0x0000000008730000-0x00000000087CC000-memory.dmp
memory/4792-136-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4792-137-0x0000000001910000-0x0000000001C5A000-memory.dmp