Analysis
- max time kernel
61s - max time network
45s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
- submitted
25/07/2022, 03:33
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.7269.exe
- Size 592KB
- Sample220725-d4appadbcp
- SHA256 a9d1fa40e50da5f6d22eee0a711265cc6340e0e8ff969c93d6113725407fbd6d
Score
10/10
Malware Config
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7269.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7269.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7269.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7269.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1156-54-0x0000000000340000-0x00000000003DA000-memory.dmp
memory/1156-55-0x00000000754F1000-0x00000000754F3000-memory.dmp
memory/1156-56-0x00000000004F0000-0x0000000000506000-memory.dmp
memory/1156-57-0x00000000003E0000-0x00000000003EA000-memory.dmp
memory/1156-58-0x0000000005F10000-0x0000000005F90000-memory.dmp
memory/1156-59-0x0000000001F90000-0x0000000001FC2000-memory.dmp
memory/1996-60-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1996-61-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1996-63-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1996-65-0x0000000000A40000-0x0000000000D43000-memory.dmp