RFQ_Beijing Chengruisi Manufacturing_pdf.exe

General
Target

RFQ_Beijing Chengruisi Manufacturing_pdf.exe

Filesize

417KB

Completed

24-09-2021 11:57

Score
10 /10
MD5

a30b50f5e2ea1a2d8c6bdf581e97d478

SHA1

9943026649061e28fe7fd626b6d3e1c893131779

SHA256

3dafcb39d7cc251c9a8212a8e745e0d72f2c530bf699a9168a379fa25e36ec38

Malware Config

Extracted

Family xloader
Version 2.5
Campaign euzn
C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

jakital.com

graywolfdesign.com

pepeavatar.com

predixlogisticscourier.com

football-transfer-news.pro

herbalmedication.xyz

esd66.com

janesgalant.quest

abcrefreshments.com

chaoxy.com

rediscoveringyouhealing.com

mcrjadr5.xyz

n4sins.com

faithful-presence.com

013yu.xyz

isystemslanka.com

newbeautydk.com

ethiopia-info.com

hgaffiliates.net

anodynemedicalmassage.com

esohgroup.com

clinicamonicabarros.com

rafathecook.com

londonescort.xyz

dreamites.com

webtiyan.com

cnnautorepair.com

soposhshop.com

aarohaninsight2021.com

arceprojects.com

Signatures 9

Filter: none

  • Xloader

    Description

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    Description

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    Tags

  • Xloader Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3844-125-0x0000000000400000-0x0000000000429000-memory.dmpxloader
    behavioral2/memory/3844-126-0x000000000041D420-mapping.dmpxloader
    behavioral2/memory/2612-133-0x0000000002E10000-0x0000000002E39000-memory.dmpxloader
  • Suspicious use of SetThreadContext
    RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.execscript.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2412 set thread context of 38442412RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exe
    PID 3844 set thread context of 3923844RFQ_Beijing Chengruisi Manufacturing_pdf.exeExplorer.EXE
    PID 2612 set thread context of 3922612cscript.exeExplorer.EXE
  • Suspicious behavior: EnumeratesProcesses
    RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.execscript.exe

    Reported IOCs

    pidprocess
    2412RFQ_Beijing Chengruisi Manufacturing_pdf.exe
    2412RFQ_Beijing Chengruisi Manufacturing_pdf.exe
    3844RFQ_Beijing Chengruisi Manufacturing_pdf.exe
    3844RFQ_Beijing Chengruisi Manufacturing_pdf.exe
    3844RFQ_Beijing Chengruisi Manufacturing_pdf.exe
    3844RFQ_Beijing Chengruisi Manufacturing_pdf.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
    2612cscript.exe
  • Suspicious behavior: GetForegroundWindowSpam
    Explorer.EXE

    Reported IOCs

    pidprocess
    392Explorer.EXE
  • Suspicious behavior: MapViewOfSection
    RFQ_Beijing Chengruisi Manufacturing_pdf.execscript.exe

    Reported IOCs

    pidprocess
    3844RFQ_Beijing Chengruisi Manufacturing_pdf.exe
    3844RFQ_Beijing Chengruisi Manufacturing_pdf.exe
    3844RFQ_Beijing Chengruisi Manufacturing_pdf.exe
    2612cscript.exe
    2612cscript.exe
  • Suspicious use of AdjustPrivilegeToken
    RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.execscript.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege2412RFQ_Beijing Chengruisi Manufacturing_pdf.exe
    Token: SeDebugPrivilege3844RFQ_Beijing Chengruisi Manufacturing_pdf.exe
    Token: SeDebugPrivilege2612cscript.exe
  • Suspicious use of WriteProcessMemory
    RFQ_Beijing Chengruisi Manufacturing_pdf.exeExplorer.EXEcscript.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2412 wrote to memory of 37522412RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exe
    PID 2412 wrote to memory of 37522412RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exe
    PID 2412 wrote to memory of 37522412RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exe
    PID 2412 wrote to memory of 38442412RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exe
    PID 2412 wrote to memory of 38442412RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exe
    PID 2412 wrote to memory of 38442412RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exe
    PID 2412 wrote to memory of 38442412RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exe
    PID 2412 wrote to memory of 38442412RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exe
    PID 2412 wrote to memory of 38442412RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exe
    PID 392 wrote to memory of 2612392Explorer.EXEcscript.exe
    PID 392 wrote to memory of 2612392Explorer.EXEcscript.exe
    PID 392 wrote to memory of 2612392Explorer.EXEcscript.exe
    PID 2612 wrote to memory of 33482612cscript.execmd.exe
    PID 2612 wrote to memory of 33482612cscript.execmd.exe
    PID 2612 wrote to memory of 33482612cscript.execmd.exe
Processes 6
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of WriteProcessMemory
    PID:392
    • C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"
        PID:3752
      • C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        PID:3844
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"
        PID:3348
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/392-136-0x0000000002660000-0x0000000002721000-memory.dmp

                          • memory/392-129-0x0000000005F40000-0x00000000060BD000-memory.dmp

                          • memory/2412-117-0x00000000059F0000-0x00000000059F1000-memory.dmp

                          • memory/2412-118-0x0000000005590000-0x0000000005591000-memory.dmp

                          • memory/2412-120-0x0000000007990000-0x0000000007991000-memory.dmp

                          • memory/2412-121-0x00000000057A0000-0x00000000057A4000-memory.dmp

                          • memory/2412-122-0x00000000054F0000-0x00000000059EE000-memory.dmp

                          • memory/2412-123-0x0000000007D40000-0x0000000007D9C000-memory.dmp

                          • memory/2412-124-0x0000000007DA0000-0x0000000007DCC000-memory.dmp

                          • memory/2412-119-0x0000000005580000-0x0000000005581000-memory.dmp

                          • memory/2412-115-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

                          • memory/2612-134-0x0000000004D10000-0x0000000005030000-memory.dmp

                          • memory/2612-132-0x00000000008C0000-0x00000000008E7000-memory.dmp

                          • memory/2612-135-0x0000000004B70000-0x0000000004C00000-memory.dmp

                          • memory/2612-130-0x0000000000000000-mapping.dmp

                          • memory/2612-133-0x0000000002E10000-0x0000000002E39000-memory.dmp

                          • memory/3348-131-0x0000000000000000-mapping.dmp

                          • memory/3844-127-0x00000000011F0000-0x0000000001510000-memory.dmp

                          • memory/3844-125-0x0000000000400000-0x0000000000429000-memory.dmp

                          • memory/3844-128-0x00000000010D0000-0x00000000010E1000-memory.dmp

                          • memory/3844-126-0x000000000041D420-mapping.dmp