Analysis
-
max time kernel
147s -
max time network
18s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-04-2021 06:54
Static task
static1
Behavioral task
behavioral1
Sample
PO-RFQ # 097663899.exe
Resource
win7v20201028
General
-
Target
PO-RFQ # 097663899.exe
-
Size
520KB
-
MD5
3a480d8d735efe129dcccea48a054721
-
SHA1
444f3d7795694fb3fd462b6cf3f5c2776e4a1196
-
SHA256
006dcd5baa67723c1d34336ca9d3eb55eb53cdb58999a8c6a3a64b28c2848220
-
SHA512
665f468fd10cab796c277b3d5e9344b00f443f837010deb810e9da0e1265d8d3d997d9e60ae467916a8807818ac0a8c63d9c40d7e5c86c89d43961174c3b68c4
Malware Config
Extracted
xloader
2.3
http://www.aquaroyaume.com/uabu/
khedutbajar.com
vehicleporn.com
misanthropedia.com
partum.life
tenshinstore.com
51tayi.com
rgr.one
lattakia-imbiss.com
escalerasdemetal.com
nationalurc.info
prettygalglam.com
globalperfumery.com
ivulam.xyz
qingniang.club
quick2ulube.com
curiget.xyz
ujeiakosdka.com
lacapitalcaferestaurant.com
agarkovsport.online
okashidonya.com
xiaoqiche.net
solothrone.com
anilfw.com
goindutch.com
buildaputt.com
salesenablementlaunch.com
olympicmeados.com
fastbetusa.com
lunaferro.com
realtimesoption.online
testci20200817122241.com
smitaaifoods.com
farmacyfastfood.com
hecmportal.net
24410restiveway.com
aaeonlineaccess.com
bigbuddyco.com
banismobarbersop.com
protectionguru.pro
almosting.com
perspectiveofgains.com
notebankers.com
southsidesportsmen.com
kopebitest.com
santiagosupermarket.com
cheap.kim
testjaycypes01.com
toyota-africa-starlet.com
sunsetplazaapts.com
favrrdrones.com
mayipay9.com
ahaal20.com
capitalsportscenter.com
betslotgames.com
thejewelcartel.com
gangubai-ramukaka.com
virtualmed101.com
sersali.com
oldschoolnews.net
sparta-mc.online
enisis.info
denversoccertraining.com
everythingkeema.com
assistancephotographe.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/328-10-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/328-11-0x000000000041D070-mapping.dmp xloader behavioral1/memory/1356-19-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1004 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO-RFQ # 097663899.exePO-RFQ # 097663899.execmstp.exedescription pid process target process PID 1064 set thread context of 328 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 328 set thread context of 1220 328 PO-RFQ # 097663899.exe Explorer.EXE PID 1356 set thread context of 1220 1356 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
PO-RFQ # 097663899.exePO-RFQ # 097663899.execmstp.exepid process 1064 PO-RFQ # 097663899.exe 1064 PO-RFQ # 097663899.exe 1064 PO-RFQ # 097663899.exe 328 PO-RFQ # 097663899.exe 328 PO-RFQ # 097663899.exe 1356 cmstp.exe 1356 cmstp.exe 1356 cmstp.exe 1356 cmstp.exe 1356 cmstp.exe 1356 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO-RFQ # 097663899.execmstp.exepid process 328 PO-RFQ # 097663899.exe 328 PO-RFQ # 097663899.exe 328 PO-RFQ # 097663899.exe 1356 cmstp.exe 1356 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO-RFQ # 097663899.exePO-RFQ # 097663899.execmstp.exedescription pid process Token: SeDebugPrivilege 1064 PO-RFQ # 097663899.exe Token: SeDebugPrivilege 328 PO-RFQ # 097663899.exe Token: SeDebugPrivilege 1356 cmstp.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
PO-RFQ # 097663899.exeExplorer.EXEcmstp.exedescription pid process target process PID 1064 wrote to memory of 1008 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 1064 wrote to memory of 1008 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 1064 wrote to memory of 1008 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 1064 wrote to memory of 1008 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 1064 wrote to memory of 328 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 1064 wrote to memory of 328 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 1064 wrote to memory of 328 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 1064 wrote to memory of 328 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 1064 wrote to memory of 328 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 1064 wrote to memory of 328 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 1064 wrote to memory of 328 1064 PO-RFQ # 097663899.exe PO-RFQ # 097663899.exe PID 1220 wrote to memory of 1356 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1356 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1356 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1356 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1356 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1356 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1356 1220 Explorer.EXE cmstp.exe PID 1356 wrote to memory of 1004 1356 cmstp.exe cmd.exe PID 1356 wrote to memory of 1004 1356 cmstp.exe cmd.exe PID 1356 wrote to memory of 1004 1356 cmstp.exe cmd.exe PID 1356 wrote to memory of 1004 1356 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO-RFQ # 097663899.exe"C:\Users\Admin\AppData\Local\Temp\PO-RFQ # 097663899.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO-RFQ # 097663899.exe"C:\Users\Admin\AppData\Local\Temp\PO-RFQ # 097663899.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PO-RFQ # 097663899.exe"C:\Users\Admin\AppData\Local\Temp\PO-RFQ # 097663899.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO-RFQ # 097663899.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/328-10-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/328-13-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/328-14-0x0000000000180000-0x0000000000191000-memory.dmpFilesize
68KB
-
memory/328-11-0x000000000041D070-mapping.dmp
-
memory/1004-21-0x0000000000000000-mapping.dmp
-
memory/1064-7-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1064-3-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/1064-8-0x0000000004E40000-0x0000000004EB5000-memory.dmpFilesize
468KB
-
memory/1064-2-0x00000000740B0000-0x000000007479E000-memory.dmpFilesize
6.9MB
-
memory/1064-6-0x0000000000AB0000-0x0000000000AB4000-memory.dmpFilesize
16KB
-
memory/1064-5-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/1064-9-0x0000000000B30000-0x0000000000B5E000-memory.dmpFilesize
184KB
-
memory/1220-15-0x0000000004BD0000-0x0000000004D45000-memory.dmpFilesize
1.5MB
-
memory/1356-16-0x0000000000000000-mapping.dmp
-
memory/1356-19-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/1356-18-0x00000000003C0000-0x00000000003D8000-memory.dmpFilesize
96KB
-
memory/1356-20-0x00000000020F0000-0x00000000023F3000-memory.dmpFilesize
3.0MB
-
memory/1356-17-0x0000000076101000-0x0000000076103000-memory.dmpFilesize
8KB
-
memory/1356-22-0x00000000005D0000-0x0000000000660000-memory.dmpFilesize
576KB