Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-10-2021 13:47
Static task
static1
Behavioral task
behavioral1
Sample
RFQ - 1100195199 - 1100190914.exe
Resource
win7-en-20210920
General
-
Target
RFQ - 1100195199 - 1100190914.exe
-
Size
373KB
-
MD5
0f3e620da62e90910e5ba126f927e84e
-
SHA1
60c1802a48d31314b47894214f89be2b20a2dc60
-
SHA256
c5d5cc8f818f3f07bd35e0255b59873957e37336ef4af224879023ecebec2342
-
SHA512
9f426f52ad331b28505ec13efc2e3f15a0fc5ddbd3481a254d19424daf5839520131478b57bc266d06410bb4396bc5af18af5916b2b78c3916dcc45486505511
Malware Config
Extracted
xloader
2.5
nc26
http://www.tattooof.info/nc26/
orangecountydeathmarch.com
blissbeautyuk.com
inarticulables.xyz
go-sbs02.com
annonces-pointvirgulefrance.com
ygcdyf.com
loftischoice.com
obesidadfceron.com
jaijin.com
kreditnekarticehr.com
proactiveline.com
sousouhenansheng.com
lynxvms.com
doujiu.xyz
getur-pckg.info
tremas25.com
jiayuesport.com
divyana.website
n1zk.xyz
benaatlc.com
jadesrc.com
fztbusragumus.com
vietnamesewriter.com
rapibest.com
omexomnimesla.com
cyblfq.com
realviennesephoto.com
pra-accessibility.com
straightii.com
starpointeartsacademy.com
centurial.space
civicinfluencers.net
formecondominium.com
tb25431.icu
authenticationtd.net
inden-store.com
rjf-s.com
terraquers.com
st-dayang.com
boarding-schools-usa.com
greysoh.xyz
sinosigns.net
joshquotes.biz
ripbiden2024.com
agbadminton.com
tuktravel.com
shly1628.com
thehomereliefdigest.com
tanakaya-jp.com
heilins.com
tagheuersrilanka.com
100crane.com
lappajarvi-info.com
lemonpropertycare.com
lingogallery.com
jessencabinets.com
siteahan.com
mygeorgecolemanfordstory.com
boatiquewear.com
wwwsmyrnaschooldistrict.com
seeindark.com
finedecoration.net
marketstreetzanzi.com
finistere.today
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2936-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2936-125-0x000000000041D410-mapping.dmp xloader behavioral2/memory/2936-128-0x0000000001220000-0x000000000136A000-memory.dmp xloader behavioral2/memory/3764-133-0x0000000004A80000-0x0000000004AA9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RFQ - 1100195199 - 1100190914.exeRFQ - 1100195199 - 1100190914.exechkdsk.exedescription pid process target process PID 4248 set thread context of 2936 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 2936 set thread context of 2712 2936 RFQ - 1100195199 - 1100190914.exe Explorer.EXE PID 3764 set thread context of 2712 3764 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
RFQ - 1100195199 - 1100190914.exeRFQ - 1100195199 - 1100190914.exechkdsk.exepid process 4248 RFQ - 1100195199 - 1100190914.exe 4248 RFQ - 1100195199 - 1100190914.exe 4248 RFQ - 1100195199 - 1100190914.exe 4248 RFQ - 1100195199 - 1100190914.exe 2936 RFQ - 1100195199 - 1100190914.exe 2936 RFQ - 1100195199 - 1100190914.exe 2936 RFQ - 1100195199 - 1100190914.exe 2936 RFQ - 1100195199 - 1100190914.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe 3764 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2712 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RFQ - 1100195199 - 1100190914.exechkdsk.exepid process 2936 RFQ - 1100195199 - 1100190914.exe 2936 RFQ - 1100195199 - 1100190914.exe 2936 RFQ - 1100195199 - 1100190914.exe 3764 chkdsk.exe 3764 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RFQ - 1100195199 - 1100190914.exeRFQ - 1100195199 - 1100190914.exechkdsk.exedescription pid process Token: SeDebugPrivilege 4248 RFQ - 1100195199 - 1100190914.exe Token: SeDebugPrivilege 2936 RFQ - 1100195199 - 1100190914.exe Token: SeDebugPrivilege 3764 chkdsk.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
RFQ - 1100195199 - 1100190914.exeExplorer.EXEchkdsk.exedescription pid process target process PID 4248 wrote to memory of 4476 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 4248 wrote to memory of 4476 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 4248 wrote to memory of 4476 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 4248 wrote to memory of 3732 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 4248 wrote to memory of 3732 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 4248 wrote to memory of 3732 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 4248 wrote to memory of 2936 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 4248 wrote to memory of 2936 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 4248 wrote to memory of 2936 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 4248 wrote to memory of 2936 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 4248 wrote to memory of 2936 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 4248 wrote to memory of 2936 4248 RFQ - 1100195199 - 1100190914.exe RFQ - 1100195199 - 1100190914.exe PID 2712 wrote to memory of 3764 2712 Explorer.EXE chkdsk.exe PID 2712 wrote to memory of 3764 2712 Explorer.EXE chkdsk.exe PID 2712 wrote to memory of 3764 2712 Explorer.EXE chkdsk.exe PID 3764 wrote to memory of 4196 3764 chkdsk.exe cmd.exe PID 3764 wrote to memory of 4196 3764 chkdsk.exe cmd.exe PID 3764 wrote to memory of 4196 3764 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ - 1100195199 - 1100190914.exe"C:\Users\Admin\AppData\Local\Temp\RFQ - 1100195199 - 1100190914.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ - 1100195199 - 1100190914.exe"C:\Users\Admin\AppData\Local\Temp\RFQ - 1100195199 - 1100190914.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ - 1100195199 - 1100190914.exe"C:\Users\Admin\AppData\Local\Temp\RFQ - 1100195199 - 1100190914.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ - 1100195199 - 1100190914.exe"C:\Users\Admin\AppData\Local\Temp\RFQ - 1100195199 - 1100190914.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ - 1100195199 - 1100190914.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2712-136-0x0000000006040000-0x00000000061AF000-memory.dmpFilesize
1.4MB
-
memory/2712-129-0x0000000005500000-0x000000000569E000-memory.dmpFilesize
1.6MB
-
memory/2936-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2936-127-0x0000000001780000-0x0000000001AA0000-memory.dmpFilesize
3.1MB
-
memory/2936-128-0x0000000001220000-0x000000000136A000-memory.dmpFilesize
1.3MB
-
memory/2936-125-0x000000000041D410-mapping.dmp
-
memory/3764-133-0x0000000004A80000-0x0000000004AA9000-memory.dmpFilesize
164KB
-
memory/3764-132-0x0000000000A50000-0x0000000000A5A000-memory.dmpFilesize
40KB
-
memory/3764-135-0x0000000005070000-0x0000000005100000-memory.dmpFilesize
576KB
-
memory/3764-134-0x0000000005320000-0x0000000005640000-memory.dmpFilesize
3.1MB
-
memory/3764-130-0x0000000000000000-mapping.dmp
-
memory/4196-131-0x0000000000000000-mapping.dmp
-
memory/4248-119-0x0000000002B10000-0x0000000002B11000-memory.dmpFilesize
4KB
-
memory/4248-118-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/4248-120-0x00000000050C0000-0x00000000055BE000-memory.dmpFilesize
5.0MB
-
memory/4248-115-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/4248-123-0x0000000007670000-0x00000000076BA000-memory.dmpFilesize
296KB
-
memory/4248-121-0x0000000002B40000-0x0000000002B46000-memory.dmpFilesize
24KB
-
memory/4248-122-0x00000000076C0000-0x00000000076C1000-memory.dmpFilesize
4KB
-
memory/4248-117-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB