Analysis
- max time kernel
90s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
30/06/2022, 08:40
General
- Target SecuriteInfo.com.Trojan.PackedNET.1400.16594.exe
- Size 523KB
- Sample220630-kkwalsbed8
- SHA256 9fcf7e78f1d76764744e18fa7f159cc3f86058d889f9f044998de5a652fb6d22
Score
10/10
Malware Config
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1400.16594.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1400.16594.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1400.16594.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1400.16594.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2988-135-0x0000000000400000-0x000000000042C000-memory.dmp
memory/2988-136-0x00000000017E0000-0x0000000001B2A000-memory.dmp
memory/4152-130-0x0000000000720000-0x00000000007A8000-memory.dmp
memory/4152-131-0x0000000007C80000-0x0000000008224000-memory.dmp
memory/4152-132-0x00000000077C0000-0x0000000007852000-memory.dmp
memory/4152-133-0x000000000AF10000-0x000000000AFAC000-memory.dmp