Analysis
-
max time kernel
145s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-06-2022 11:50
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
Resource
win7-20220414-en
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
-
Size
448KB
-
MD5
4cfcb2976dc600ecd5e61ee012d2cf80
-
SHA1
bb6405e828b4f43846e2bf5dcfda7ccad2c204a3
-
SHA256
af734d11eb2809d171ff3e63096cb2cbd38ee44a6e4b9e0ab195498635208598
-
SHA512
9743553db9ce03ba401b14e9c018957b94e6b42ed2cf430432ef2d9fa7343ce1b16439842457465ad1d0960a3ee72881b130f8a35cce06b2e1475e1b2f03d6a2
Malware Config
Extracted
xloader
2.5
r87g
gzjyjzsj.com
rapibest.com
affordablebathroomsbyfrank.net
roboruben.com
xn--dlisucr-byag.com
encoreasso.com
piscire.com
dixiebusybee.com
newrome.xyz
sunshinejon.com
glacierforfcs.xyz
borhanmarket.com
tous-des-cons.club
hsfstea.com
spiniform.info
vaicomfibra.com
shinigami.xyz
kryptoindia.com
listentoappetite.com
securepplpay.com
savannabrazell.com
dallascowboysticket.online
lemuria4.online
pakistaninusa.com
realdigitaldivide.com
nameandlikenesslabs.com
icris2021.com
amorporlaropa.com
xgirlstar.com
localhuktoyof6.xyz
about-times.xyz
withvertex.com
newtajmahalfashion.xyz
myapple3.com
sjitcom.com
shemanifesteverything.com
nft2yuan.com
misfitlamps.com
nordicautoparts.net
precisecleanteam.com
unmoro.com
gh-michikusa.com
usbgdt.net
ordt.xyz
hcaptchabypass.com
samedaycash.loan
lavistacaffe.com
alicekay.online
aceproservices.net
androidapdate.com
kredsen.website
southwinds-kolkata.com
069superbetin.com
adorablymeboutique.store
xbet973.com
xn--czrr40i.xn--io0a7i
shadow-marketing.com
license-plate-find.online
wwwoneparkfinancial.com
milehighrenewals.com
scyxmq.com
mbdeyren.com
nottryingdoing.com
homesandhorse.com
stpaulsschoolbagidora.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3956-140-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19961.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.W32.AIDetectNet.01.19961.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19961.exedescription pid process target process PID 4692 set thread context of 3956 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe SecuriteInfo.com.W32.AIDetectNet.01.19961.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeSecuriteInfo.com.W32.AIDetectNet.01.19961.exepid process 4912 powershell.exe 3956 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe 3956 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe 4912 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4912 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19961.exedescription pid process target process PID 4692 wrote to memory of 4912 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe powershell.exe PID 4692 wrote to memory of 4912 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe powershell.exe PID 4692 wrote to memory of 4912 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe powershell.exe PID 4692 wrote to memory of 4084 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe schtasks.exe PID 4692 wrote to memory of 4084 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe schtasks.exe PID 4692 wrote to memory of 4084 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe schtasks.exe PID 4692 wrote to memory of 3956 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe SecuriteInfo.com.W32.AIDetectNet.01.19961.exe PID 4692 wrote to memory of 3956 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe SecuriteInfo.com.W32.AIDetectNet.01.19961.exe PID 4692 wrote to memory of 3956 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe SecuriteInfo.com.W32.AIDetectNet.01.19961.exe PID 4692 wrote to memory of 3956 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe SecuriteInfo.com.W32.AIDetectNet.01.19961.exe PID 4692 wrote to memory of 3956 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe SecuriteInfo.com.W32.AIDetectNet.01.19961.exe PID 4692 wrote to memory of 3956 4692 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19961.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19961.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hJzNgUBNjbq.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hJzNgUBNjbq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD49.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19961.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19961.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD49.tmpFilesize
1KB
MD51c9233ba7e8416cfce6d0f9be0b60829
SHA19955c1e8ee38927b359f6d29ee36cf5fc74fd9f8
SHA25668a8e2b057c82b41f0c3f055eddb0e55ee1e3a0767fa6534661d505cdeff1fc9
SHA512eff59b83fe243aaf2224b51a525c982fdf26c33efdf1ad53597564e6279f999223ad95144c6f53db1a59eee8960fa7f3d16ce42e088d9bf8ac3d316e4aeb7683
-
memory/3956-140-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3956-144-0x0000000001810000-0x0000000001B5A000-memory.dmpFilesize
3.3MB
-
memory/3956-139-0x0000000000000000-mapping.dmp
-
memory/4084-136-0x0000000000000000-mapping.dmp
-
memory/4692-131-0x00000000056B0000-0x0000000005C54000-memory.dmpFilesize
5.6MB
-
memory/4692-132-0x00000000051A0000-0x0000000005232000-memory.dmpFilesize
584KB
-
memory/4692-133-0x0000000005160000-0x000000000516A000-memory.dmpFilesize
40KB
-
memory/4692-134-0x0000000007D00000-0x0000000007D9C000-memory.dmpFilesize
624KB
-
memory/4692-130-0x00000000008B0000-0x0000000000920000-memory.dmpFilesize
448KB
-
memory/4912-142-0x0000000004E00000-0x0000000004E22000-memory.dmpFilesize
136KB
-
memory/4912-149-0x0000000006170000-0x000000000618E000-memory.dmpFilesize
120KB
-
memory/4912-138-0x0000000002350000-0x0000000002386000-memory.dmpFilesize
216KB
-
memory/4912-135-0x0000000000000000-mapping.dmp
-
memory/4912-143-0x0000000005560000-0x00000000055C6000-memory.dmpFilesize
408KB
-
memory/4912-145-0x0000000005640000-0x00000000056A6000-memory.dmpFilesize
408KB
-
memory/4912-146-0x0000000005C50000-0x0000000005C6E000-memory.dmpFilesize
120KB
-
memory/4912-147-0x0000000006190000-0x00000000061C2000-memory.dmpFilesize
200KB
-
memory/4912-148-0x0000000071AD0000-0x0000000071B1C000-memory.dmpFilesize
304KB
-
memory/4912-141-0x0000000004E40000-0x0000000005468000-memory.dmpFilesize
6.2MB
-
memory/4912-150-0x0000000007540000-0x0000000007BBA000-memory.dmpFilesize
6.5MB
-
memory/4912-151-0x0000000006EE0000-0x0000000006EFA000-memory.dmpFilesize
104KB
-
memory/4912-152-0x0000000006F40000-0x0000000006F4A000-memory.dmpFilesize
40KB
-
memory/4912-153-0x0000000007170000-0x0000000007206000-memory.dmpFilesize
600KB
-
memory/4912-154-0x0000000007120000-0x000000000712E000-memory.dmpFilesize
56KB
-
memory/4912-155-0x0000000007210000-0x000000000722A000-memory.dmpFilesize
104KB
-
memory/4912-156-0x0000000007160000-0x0000000007168000-memory.dmpFilesize
32KB