Analysis
- max time kernel
56s - max time network
45s - platform
windows7_x64 - resource
win7-20220414-en - submitted
22/06/2022, 05:41
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.25390.exe
- Size 454KB
- Sample220622-gdeshagfdm
- SHA256 0323d5159dd1425833a2b88830923e17810a4bbbc70dd686702ce4fad69d65e4
Score
10/10
Malware Config
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.25390.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.25390.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.25390.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.25390.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1264-59-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1264-60-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1264-62-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1264-64-0x0000000000AA0000-0x0000000000DA3000-memory.dmp
memory/1708-54-0x0000000000A20000-0x0000000000A98000-memory.dmp
memory/1708-55-0x0000000075A61000-0x0000000075A63000-memory.dmp
memory/1708-56-0x0000000000450000-0x000000000045E000-memory.dmp
memory/1708-57-0x0000000004E80000-0x0000000004EEA000-memory.dmp
memory/1708-58-0x0000000000550000-0x0000000000582000-memory.dmp