Analysis
- max time kernel
63s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
22/06/2022, 05:41
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.25390.exe
- Size 454KB
- Sample220622-gdeshagfdm
- SHA256 0323d5159dd1425833a2b88830923e17810a4bbbc70dd686702ce4fad69d65e4
Score
10/10
Malware Config
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.25390.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.25390.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.25390.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.25390.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/64-136-0x0000000000400000-0x000000000042C000-memory.dmp
memory/64-137-0x00000000011C0000-0x000000000150A000-memory.dmp
memory/3288-130-0x0000000000730000-0x00000000007A8000-memory.dmp
memory/3288-131-0x0000000005710000-0x0000000005CB4000-memory.dmp
memory/3288-132-0x0000000005160000-0x00000000051F2000-memory.dmp
memory/3288-133-0x0000000005130000-0x000000000513A000-memory.dmp
memory/3288-134-0x0000000008D50000-0x0000000008DEC000-memory.dmp