Analysis
- max time kernel
149s - max time network
152s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
23/09/2021, 00:56
General
- Target RFQ_Beijing Chengruisi Manufacturing_pdf.exe
- Size 757KB
- Sample210923-bac7lsebc4
- SHA256 662ae2a76488e0f775884f0c19daa286c910f2e72acb414a5f820b655ef42565
Malware Config
Extracted
-
xloader
-
2.5
-
euzn
-
http://www.heser.net/euzn/
-
235296tyc.com
-
gold12guide.art
-
baibuaherb.com
-
weberwines.tax
-
chezvitoria.com
-
aidenb.tech
-
pitchdeckservice.com
-
surgeryforfdf.xyz
-
workunvaccinated.com
-
hrtaro.com
-
yourotcs.com
-
sonimultispecialityclinic.com
-
consultantadvisors.com
-
pentesting-consulting.com
-
dantechs.digital
-
longshifa.online
-
taweilai.net
-
imyusuke.com
-
cashndashfinancial.com
-
fasiglimt.quest
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Blocklisted process makes network request 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2056-126-0x00000000081E0000-0x000000000821A000-memory.dmp
memory/2056-124-0x0000000007F00000-0x0000000007F01000-memory.dmp
memory/2056-118-0x00000000051F0000-0x00000000051F1000-memory.dmp
memory/2056-119-0x0000000005340000-0x0000000005341000-memory.dmp
memory/2056-120-0x0000000005B50000-0x0000000005B51000-memory.dmp
memory/2056-121-0x0000000005600000-0x0000000005601000-memory.dmp
memory/2056-122-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/2056-123-0x0000000007BC0000-0x0000000007BDD000-memory.dmp
memory/2056-115-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/2056-125-0x0000000008150000-0x00000000081BA000-memory.dmp
memory/2056-117-0x0000000005650000-0x0000000005651000-memory.dmp
memory/3028-131-0x0000000002D70000-0x0000000002E3E000-memory.dmp
memory/3028-138-0x0000000005610000-0x0000000005739000-memory.dmp
memory/3040-127-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3040-130-0x00000000010E0000-0x00000000010F1000-memory.dmp
memory/3040-129-0x0000000001180000-0x00000000014A0000-memory.dmp
memory/3392-134-0x0000000000830000-0x0000000000859000-memory.dmp
memory/3392-133-0x0000000000A30000-0x0000000000A46000-memory.dmp
memory/3392-136-0x0000000004990000-0x0000000004CB0000-memory.dmp
memory/3392-137-0x00000000046E0000-0x0000000004770000-memory.dmp