Analysis
-
max time kernel
153s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
24-09-2021 12:04
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_Beijing Chengruisi Manufacturing_pdf.exe
Resource
win7-en-20210920
General
-
Target
RFQ_Beijing Chengruisi Manufacturing_pdf.exe
-
Size
417KB
-
MD5
a30b50f5e2ea1a2d8c6bdf581e97d478
-
SHA1
9943026649061e28fe7fd626b6d3e1c893131779
-
SHA256
3dafcb39d7cc251c9a8212a8e745e0d72f2c530bf699a9168a379fa25e36ec38
-
SHA512
548ca8b3f795c32ff30d4f4810e78c6a0bb2aecf42a4bc56632612b2ab5595d9d4d3fd364b6c9bcca80135f1459f7243edc020a2b61bb3b1bce04d43d79a8088
Malware Config
Extracted
xloader
2.5
euzn
http://www.heser.net/euzn/
235296tyc.com
gold12guide.art
baibuaherb.com
weberwines.tax
chezvitoria.com
aidenb.tech
pitchdeckservice.com
surgeryforfdf.xyz
workunvaccinated.com
hrtaro.com
yourotcs.com
sonimultispecialityclinic.com
consultantadvisors.com
pentesting-consulting.com
dantechs.digital
longshifa.online
taweilai.net
imyusuke.com
cashndashfinancial.com
fasiglimt.quest
jakital.com
graywolfdesign.com
pepeavatar.com
predixlogisticscourier.com
football-transfer-news.pro
herbalmedication.xyz
esd66.com
janesgalant.quest
abcrefreshments.com
chaoxy.com
rediscoveringyouhealing.com
mcrjadr5.xyz
n4sins.com
faithful-presence.com
013yu.xyz
isystemslanka.com
newbeautydk.com
ethiopia-info.com
hgaffiliates.net
anodynemedicalmassage.com
esohgroup.com
clinicamonicabarros.com
rafathecook.com
londonescort.xyz
dreamites.com
webtiyan.com
cnnautorepair.com
soposhshop.com
aarohaninsight2021.com
arceprojects.com
mecasso.store
mirai-energy.com
barwg.com
angeescollections-shop.com
xinlishiqiaoqiao.xyz
linuxsauce.net
dirbn.com
anandiaper.xyz
blackpanther.online
livinwoodbridgefarms.com
diepraxiskommunikation.com
radiosaptshahid.com
gofieldtest.com
minxtales.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2348-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2348-126-0x000000000041D420-mapping.dmp xloader behavioral2/memory/2536-132-0x0000000003240000-0x0000000003269000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exeexplorer.exedescription pid process target process PID 1808 set thread context of 2348 1808 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2348 set thread context of 2972 2348 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Explorer.EXE PID 2536 set thread context of 2972 2536 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeexplorer.exepid process 2348 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2348 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2348 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2348 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2972 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeexplorer.exepid process 2348 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2348 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2348 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2536 explorer.exe 2536 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2348 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Token: SeDebugPrivilege 2536 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeExplorer.EXEexplorer.exedescription pid process target process PID 1808 wrote to memory of 2348 1808 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1808 wrote to memory of 2348 1808 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1808 wrote to memory of 2348 1808 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1808 wrote to memory of 2348 1808 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1808 wrote to memory of 2348 1808 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1808 wrote to memory of 2348 1808 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2972 wrote to memory of 2536 2972 Explorer.EXE explorer.exe PID 2972 wrote to memory of 2536 2972 Explorer.EXE explorer.exe PID 2972 wrote to memory of 2536 2972 Explorer.EXE explorer.exe PID 2536 wrote to memory of 2788 2536 explorer.exe cmd.exe PID 2536 wrote to memory of 2788 2536 explorer.exe cmd.exe PID 2536 wrote to memory of 2788 2536 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1808-115-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/1808-117-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/1808-118-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/1808-119-0x00000000054A0000-0x0000000005532000-memory.dmpFilesize
584KB
-
memory/1808-120-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/1808-121-0x0000000007960000-0x0000000007961000-memory.dmpFilesize
4KB
-
memory/1808-122-0x0000000005A50000-0x0000000005A54000-memory.dmpFilesize
16KB
-
memory/1808-123-0x0000000007CB0000-0x0000000007D0C000-memory.dmpFilesize
368KB
-
memory/1808-124-0x0000000007D30000-0x0000000007D5C000-memory.dmpFilesize
176KB
-
memory/2348-126-0x000000000041D420-mapping.dmp
-
memory/2348-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2348-127-0x0000000001A80000-0x0000000001DA0000-memory.dmpFilesize
3.1MB
-
memory/2348-128-0x0000000001970000-0x0000000001981000-memory.dmpFilesize
68KB
-
memory/2536-130-0x0000000000000000-mapping.dmp
-
memory/2536-131-0x0000000000E00000-0x000000000123F000-memory.dmpFilesize
4.2MB
-
memory/2536-132-0x0000000003240000-0x0000000003269000-memory.dmpFilesize
164KB
-
memory/2536-133-0x0000000005220000-0x0000000005540000-memory.dmpFilesize
3.1MB
-
memory/2536-135-0x0000000004FE0000-0x0000000005070000-memory.dmpFilesize
576KB
-
memory/2788-134-0x0000000000000000-mapping.dmp
-
memory/2972-129-0x0000000005A10000-0x0000000005B1C000-memory.dmpFilesize
1.0MB
-
memory/2972-136-0x0000000006B30000-0x0000000006C3F000-memory.dmpFilesize
1.1MB