Overview

overview

10

Static

static

SecuriteIn...29.exe

windows7_x64

10

SecuriteIn...29.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    52s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    04/07/2022, 02:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.W32.AIDetectNet.01.20029.exe
  • Size 540KB
  • Sample220704-c8gs5aebap
  • SHA256 9e82eaa621706db6869429ade66b7744466f1f1cdb4dfc9dfdc38da681dbb181
  • MD5 SHA1 SHA512
Score
10/10
xloaderceahloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • ceah

Decoy

  • discover4two.com

  • crcteamrealty.com

  • blueheronvillaweddings.com

  • scrunchiespree.com

  • agencedepartementaleauth-ca.com

  • hudsonvalleyhairloss.com

  • heraromatickitchen.com

  • stagecook.com

  • khukhuannhamay.com

  • sharpharbor.com

  • tanba-dekanshofarm.net

  • bajajfinservmutualfunds.com

  • drtht.com

  • mantadod.quest

  • emergencyhomerepairnetwork.com

  • victorlemairevoixoff.com

  • supplementstoreryp.com

  • promedika.info

  • highlow-bnr.info

  • pricklypairjazz.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.20029.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.20029.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.20029.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.20029.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1708

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/852-54-0x0000000001050000-0x00000000010DC000-memory.dmp
        Download

        memory/852-55-0x0000000076781000-0x0000000076783000-memory.dmp
        Download

        memory/852-56-0x00000000009E0000-0x00000000009F6000-memory.dmp
        Download

        memory/852-57-0x0000000000BE0000-0x0000000000BEA000-memory.dmp
        Download

        memory/852-58-0x0000000005EF0000-0x0000000005F68000-memory.dmp
        Download

        memory/852-59-0x0000000000F00000-0x0000000000F30000-memory.dmp
        Download

        memory/1708-60-0x0000000000400000-0x0000000000429000-memory.dmp
        Download

        memory/1708-61-0x0000000000400000-0x0000000000429000-memory.dmp
        Download

        memory/1708-63-0x0000000000400000-0x0000000000429000-memory.dmp
        Download

        memory/1708-65-0x0000000000830000-0x0000000000B33000-memory.dmp
        Download