Analysis
- max time kernel
151s - max time network
179s - platform
windows7_x64 - resource
win7v20210408 - submitted
23/09/2021, 00:56
General
- Target RFQ_Beijing Chengruisi Manufacturing_pdf.exe
- Size 757KB
- Sample210923-bac7lsebc4
- SHA256 662ae2a76488e0f775884f0c19daa286c910f2e72acb414a5f820b655ef42565
Malware Config
Extracted
-
xloader
-
2.5
-
euzn
-
http://www.heser.net/euzn/
-
235296tyc.com
-
gold12guide.art
-
baibuaherb.com
-
weberwines.tax
-
chezvitoria.com
-
aidenb.tech
-
pitchdeckservice.com
-
surgeryforfdf.xyz
-
workunvaccinated.com
-
hrtaro.com
-
yourotcs.com
-
sonimultispecialityclinic.com
-
consultantadvisors.com
-
pentesting-consulting.com
-
dantechs.digital
-
longshifa.online
-
taweilai.net
-
imyusuke.com
-
cashndashfinancial.com
-
fasiglimt.quest
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/932-68-0x0000000000880000-0x0000000000B83000-memory.dmp
memory/932-69-0x0000000000430000-0x0000000000441000-memory.dmp
memory/932-66-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1212-77-0x0000000004E80000-0x0000000004FF4000-memory.dmp
memory/1212-70-0x0000000003E20000-0x0000000003ED6000-memory.dmp
memory/1824-65-0x0000000000A90000-0x0000000000ACA000-memory.dmp
memory/1824-60-0x0000000001190000-0x0000000001191000-memory.dmp
memory/1824-64-0x00000000058E0000-0x000000000594A000-memory.dmp
memory/1824-63-0x0000000000950000-0x000000000096D000-memory.dmp
memory/1824-62-0x0000000001050000-0x0000000001051000-memory.dmp
memory/1876-73-0x0000000000270000-0x0000000000277000-memory.dmp
memory/1876-74-0x00000000000C0000-0x00000000000E9000-memory.dmp
memory/1876-75-0x0000000001F50000-0x0000000002253000-memory.dmp
memory/1876-76-0x0000000001E50000-0x0000000001EE0000-memory.dmp