Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
07/07/2022, 03:42
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.24290.exe
- Size 269KB
- Sample220707-d9b5psegc9
- SHA256 8054dd2e45880794d187893bf7274cb69cc628baa62eec2a2dfb514af50c37c4
Malware Config
Extracted
-
xloader
-
2.6
-
tn61
-
ryliehorrall.art
-
mesdco.net
-
street-art-ink.com
-
sepetcin.com
-
stilghar.com
-
hawaiipooltiles.com
-
fuerst-von-falkennest.com
-
totalvirtue.com
-
xdk0blc0tqy6a7.life
-
zootowngravel.com
-
kreditkarten-optionde.com
-
6888tlbb.xyz
-
albertakleekai.com
-
travelnurseinfofinder3.life
-
valleyinnswat.com
-
secure-remove-devices.com
-
digitalswamy.com
-
www112casinova.com
-
medifasttrd.com
-
distritoxermar.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.24290.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.24290.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/920-143-0x00000000025A0000-0x0000000002630000-memory.dmp
memory/920-145-0x00000000005D0000-0x00000000005FB000-memory.dmp
memory/920-142-0x0000000002840000-0x0000000002B8A000-memory.dmp
memory/920-139-0x0000000000D20000-0x0000000000D3F000-memory.dmp
memory/920-140-0x00000000005D0000-0x00000000005FB000-memory.dmp
memory/2952-146-0x0000000008170000-0x0000000008280000-memory.dmp
memory/2952-144-0x0000000008170000-0x0000000008280000-memory.dmp
memory/2952-137-0x0000000007FD0000-0x000000000816A000-memory.dmp
memory/3804-136-0x00000000010A0000-0x00000000010B1000-memory.dmp
memory/3804-135-0x00000000010C0000-0x000000000140A000-memory.dmp
memory/3804-134-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3804-132-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4608-130-0x0000000000950000-0x0000000000996000-memory.dmp