Analysis
- max time kernel
61s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
- submitted
25/07/2022, 03:33
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.7269.exe
- Size 592KB
- Sample220725-d4appadbcp
- SHA256 a9d1fa40e50da5f6d22eee0a711265cc6340e0e8ff969c93d6113725407fbd6d
Score
10/10
Malware Config
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7269.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7269.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7269.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7269.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/844-137-0x0000000000400000-0x000000000042C000-memory.dmp
memory/844-138-0x0000000001150000-0x000000000149A000-memory.dmp
memory/4124-130-0x0000000000040000-0x00000000000DA000-memory.dmp
memory/4124-131-0x0000000004F10000-0x00000000054B4000-memory.dmp
memory/4124-132-0x0000000004A50000-0x0000000004AE2000-memory.dmp
memory/4124-133-0x0000000004BE0000-0x0000000004BEA000-memory.dmp
memory/4124-134-0x000000000A0B0000-0x000000000A14C000-memory.dmp
memory/4124-135-0x000000000A1C0000-0x000000000A226000-memory.dmp