Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
24-09-2021 11:55
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_Beijing Chengruisi Manufacturing_pdf.exe
Resource
win7v20210408
General
-
Target
RFQ_Beijing Chengruisi Manufacturing_pdf.exe
-
Size
417KB
-
MD5
a30b50f5e2ea1a2d8c6bdf581e97d478
-
SHA1
9943026649061e28fe7fd626b6d3e1c893131779
-
SHA256
3dafcb39d7cc251c9a8212a8e745e0d72f2c530bf699a9168a379fa25e36ec38
-
SHA512
548ca8b3f795c32ff30d4f4810e78c6a0bb2aecf42a4bc56632612b2ab5595d9d4d3fd364b6c9bcca80135f1459f7243edc020a2b61bb3b1bce04d43d79a8088
Malware Config
Extracted
xloader
2.5
euzn
http://www.heser.net/euzn/
235296tyc.com
gold12guide.art
baibuaherb.com
weberwines.tax
chezvitoria.com
aidenb.tech
pitchdeckservice.com
surgeryforfdf.xyz
workunvaccinated.com
hrtaro.com
yourotcs.com
sonimultispecialityclinic.com
consultantadvisors.com
pentesting-consulting.com
dantechs.digital
longshifa.online
taweilai.net
imyusuke.com
cashndashfinancial.com
fasiglimt.quest
jakital.com
graywolfdesign.com
pepeavatar.com
predixlogisticscourier.com
football-transfer-news.pro
herbalmedication.xyz
esd66.com
janesgalant.quest
abcrefreshments.com
chaoxy.com
rediscoveringyouhealing.com
mcrjadr5.xyz
n4sins.com
faithful-presence.com
013yu.xyz
isystemslanka.com
newbeautydk.com
ethiopia-info.com
hgaffiliates.net
anodynemedicalmassage.com
esohgroup.com
clinicamonicabarros.com
rafathecook.com
londonescort.xyz
dreamites.com
webtiyan.com
cnnautorepair.com
soposhshop.com
aarohaninsight2021.com
arceprojects.com
mecasso.store
mirai-energy.com
barwg.com
angeescollections-shop.com
xinlishiqiaoqiao.xyz
linuxsauce.net
dirbn.com
anandiaper.xyz
blackpanther.online
livinwoodbridgefarms.com
diepraxiskommunikation.com
radiosaptshahid.com
gofieldtest.com
minxtales.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3844-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3844-126-0x000000000041D420-mapping.dmp xloader behavioral2/memory/2612-133-0x0000000002E10000-0x0000000002E39000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.execscript.exedescription pid process target process PID 2412 set thread context of 3844 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 3844 set thread context of 392 3844 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Explorer.EXE PID 2612 set thread context of 392 2612 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.execscript.exepid process 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 3844 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 3844 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 3844 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 3844 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe 2612 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 392 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.execscript.exepid process 3844 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 3844 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 3844 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2612 cscript.exe 2612 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.execscript.exedescription pid process Token: SeDebugPrivilege 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Token: SeDebugPrivilege 3844 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Token: SeDebugPrivilege 2612 cscript.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeExplorer.EXEcscript.exedescription pid process target process PID 2412 wrote to memory of 3752 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2412 wrote to memory of 3752 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2412 wrote to memory of 3752 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2412 wrote to memory of 3844 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2412 wrote to memory of 3844 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2412 wrote to memory of 3844 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2412 wrote to memory of 3844 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2412 wrote to memory of 3844 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2412 wrote to memory of 3844 2412 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 392 wrote to memory of 2612 392 Explorer.EXE cscript.exe PID 392 wrote to memory of 2612 392 Explorer.EXE cscript.exe PID 392 wrote to memory of 2612 392 Explorer.EXE cscript.exe PID 2612 wrote to memory of 3348 2612 cscript.exe cmd.exe PID 2612 wrote to memory of 3348 2612 cscript.exe cmd.exe PID 2612 wrote to memory of 3348 2612 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-136-0x0000000002660000-0x0000000002721000-memory.dmpFilesize
772KB
-
memory/392-129-0x0000000005F40000-0x00000000060BD000-memory.dmpFilesize
1.5MB
-
memory/2412-120-0x0000000007990000-0x0000000007991000-memory.dmpFilesize
4KB
-
memory/2412-118-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/2412-115-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/2412-121-0x00000000057A0000-0x00000000057A4000-memory.dmpFilesize
16KB
-
memory/2412-122-0x00000000054F0000-0x00000000059EE000-memory.dmpFilesize
5.0MB
-
memory/2412-123-0x0000000007D40000-0x0000000007D9C000-memory.dmpFilesize
368KB
-
memory/2412-124-0x0000000007DA0000-0x0000000007DCC000-memory.dmpFilesize
176KB
-
memory/2412-119-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/2412-117-0x00000000059F0000-0x00000000059F1000-memory.dmpFilesize
4KB
-
memory/2612-132-0x00000000008C0000-0x00000000008E7000-memory.dmpFilesize
156KB
-
memory/2612-135-0x0000000004B70000-0x0000000004C00000-memory.dmpFilesize
576KB
-
memory/2612-134-0x0000000004D10000-0x0000000005030000-memory.dmpFilesize
3.1MB
-
memory/2612-130-0x0000000000000000-mapping.dmp
-
memory/2612-133-0x0000000002E10000-0x0000000002E39000-memory.dmpFilesize
164KB
-
memory/3348-131-0x0000000000000000-mapping.dmp
-
memory/3844-128-0x00000000010D0000-0x00000000010E1000-memory.dmpFilesize
68KB
-
memory/3844-127-0x00000000011F0000-0x0000000001510000-memory.dmpFilesize
3.1MB
-
memory/3844-126-0x000000000041D420-mapping.dmp
-
memory/3844-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB