Analysis
-
max time kernel
148s -
max time network
186s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 12:37
Static task
static1
General
-
Target
RFQ Rosemount.exe
-
Size
1.3MB
-
MD5
58f2fc9e3b1e045d4f6040e0b15e7b3d
-
SHA1
3fd996467fc1b057e9f0fe436dd7f46cf460e688
-
SHA256
5d73a302ff09dd9d39420703dc50c9530ac6e78b55c762f9c03df76be39d6c2c
-
SHA512
a4d0627fedf36e64aca0dd5154189d0fd280f212adc8e700c3e01ce6a4fe818454b7f3afe79ae37d45b990573be9eaf8d9d3ef58aed2cb19f27d66c64c94d044
Malware Config
Extracted
xloader
2.3
http://www.lapashawhite.com/p596/
ushistorical.com
lovepropertylondon.com
acupress-the-point.com
3772548.com
ambientabuse.com
primaveracm.com
themidwestmomblog.com
havasavunma.com
rockyroadbrand.com
zzphys.com
masque-inclusif.com
myeonyeokplus.com
linkernet.pro
zezirma.com
mysiniar.com
andreamall.com
mattesonauto.com
wandopowerinc.com
casaurgence.com
salishseaquilts.com
yourchanceisnow.com
tumulusresearch.com
blendandspend.com
pevention.com
cloudrevolutionawards.com
beadedbodied.com
marylandpaymentrelief.net
5935699.com
silverleafcompanies.com
slxxxhub.com
combatstriking.com
sex-shop.life
cuncunkan.com
italiamo-magagine.com
sfvoterguide.com
2012boulevard.com
mslookbook.com
897tj1.net
cgslnc.net
kashyaptalkz.com
researchcse.com
lunzhu168.com
mlfkt.com
customcardstudio.com
kirklandramblerforsale.com
magetu.info
wptheme247.com
purposedenver.com
journaldelaphotographie.com
yieldwadi.site
mobilefriendlysites.com
ocularjournal.com
consigli.energy
infintylights.com
itcohempproject.com
montcairo.net
allegrohascockroaches.com
flexbandofficial.com
greatindiapropertyshow.com
kabin-fever.com
designsoc.com
javlao.com
controltower.services
masihsarap.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/776-65-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/776-66-0x000000000041D060-mapping.dmp xloader behavioral1/memory/560-74-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1764 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
RFQ Rosemount.exeRFQ Rosemount.exehelp.exedescription pid process target process PID 1164 set thread context of 776 1164 RFQ Rosemount.exe RFQ Rosemount.exe PID 776 set thread context of 1264 776 RFQ Rosemount.exe Explorer.EXE PID 776 set thread context of 1264 776 RFQ Rosemount.exe Explorer.EXE PID 560 set thread context of 1264 560 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
RFQ Rosemount.exeRFQ Rosemount.exehelp.exepid process 1164 RFQ Rosemount.exe 776 RFQ Rosemount.exe 776 RFQ Rosemount.exe 776 RFQ Rosemount.exe 560 help.exe 560 help.exe 560 help.exe 560 help.exe 560 help.exe 560 help.exe 560 help.exe 560 help.exe 560 help.exe 560 help.exe 560 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RFQ Rosemount.exehelp.exepid process 776 RFQ Rosemount.exe 776 RFQ Rosemount.exe 776 RFQ Rosemount.exe 776 RFQ Rosemount.exe 560 help.exe 560 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RFQ Rosemount.exeRFQ Rosemount.exehelp.exedescription pid process Token: SeDebugPrivilege 1164 RFQ Rosemount.exe Token: SeDebugPrivilege 776 RFQ Rosemount.exe Token: SeDebugPrivilege 560 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
RFQ Rosemount.exeRFQ Rosemount.exehelp.exedescription pid process target process PID 1164 wrote to memory of 776 1164 RFQ Rosemount.exe RFQ Rosemount.exe PID 1164 wrote to memory of 776 1164 RFQ Rosemount.exe RFQ Rosemount.exe PID 1164 wrote to memory of 776 1164 RFQ Rosemount.exe RFQ Rosemount.exe PID 1164 wrote to memory of 776 1164 RFQ Rosemount.exe RFQ Rosemount.exe PID 1164 wrote to memory of 776 1164 RFQ Rosemount.exe RFQ Rosemount.exe PID 1164 wrote to memory of 776 1164 RFQ Rosemount.exe RFQ Rosemount.exe PID 1164 wrote to memory of 776 1164 RFQ Rosemount.exe RFQ Rosemount.exe PID 776 wrote to memory of 560 776 RFQ Rosemount.exe help.exe PID 776 wrote to memory of 560 776 RFQ Rosemount.exe help.exe PID 776 wrote to memory of 560 776 RFQ Rosemount.exe help.exe PID 776 wrote to memory of 560 776 RFQ Rosemount.exe help.exe PID 560 wrote to memory of 1764 560 help.exe cmd.exe PID 560 wrote to memory of 1764 560 help.exe cmd.exe PID 560 wrote to memory of 1764 560 help.exe cmd.exe PID 560 wrote to memory of 1764 560 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\RFQ Rosemount.exe"C:\Users\Admin\AppData\Local\Temp\RFQ Rosemount.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ Rosemount.exe"C:\Users\Admin\AppData\Local\Temp\RFQ Rosemount.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ Rosemount.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-76-0x0000000000730000-0x0000000000A33000-memory.dmpFilesize
3.0MB
-
memory/560-77-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/560-74-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/560-73-0x0000000000180000-0x0000000000186000-memory.dmpFilesize
24KB
-
memory/560-72-0x0000000000000000-mapping.dmp
-
memory/560-78-0x00000000005F0000-0x0000000000680000-memory.dmpFilesize
576KB
-
memory/776-68-0x0000000000180000-0x0000000000191000-memory.dmpFilesize
68KB
-
memory/776-67-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/776-66-0x000000000041D060-mapping.dmp
-
memory/776-65-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/776-70-0x00000000002D0000-0x00000000002E1000-memory.dmpFilesize
68KB
-
memory/1164-59-0x0000000000DF0000-0x0000000000DF1000-memory.dmpFilesize
4KB
-
memory/1164-64-0x00000000006A0000-0x00000000006CB000-memory.dmpFilesize
172KB
-
memory/1164-63-0x00000000053E0000-0x000000000544F000-memory.dmpFilesize
444KB
-
memory/1164-62-0x00000000004A0000-0x00000000004CD000-memory.dmpFilesize
180KB
-
memory/1164-61-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/1264-71-0x0000000006BF0000-0x0000000006D1E000-memory.dmpFilesize
1.2MB
-
memory/1264-79-0x0000000004D80000-0x0000000004E2E000-memory.dmpFilesize
696KB
-
memory/1264-69-0x0000000006580000-0x000000000668C000-memory.dmpFilesize
1.0MB
-
memory/1764-75-0x0000000000000000-mapping.dmp