Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
28-10-2021 13:49
Static task
static1
Behavioral task
behavioral1
Sample
RFQ#.exe
Resource
win7-en-20211014
General
-
Target
RFQ#.exe
-
Size
296KB
-
MD5
3838c43e12f0c22ecf9a9a0c1deb1d30
-
SHA1
7b9d8e4a093672411f71f1cf6a7fe6803c61773c
-
SHA256
b980dfcce93e9140d8ce71151f2f385026b8cebc195b71055707e1468ad0131b
-
SHA512
f0f860a56500b449b29558dc6e8860ce4441cee2612cc22c7cb9aaf5106062e290e3b3313dd0eef55fe1678791992f0502dbda9d0350110b7f7591853445935c
Malware Config
Extracted
xloader
2.5
unzn
http://www.davanamays.com/unzn/
xiulf.com
highcountrymortar.com
523561.com
marketingagency.tools
ganmovie.net
nationaalcontactpunt.com
sirrbter.com
begizas.xyz
missimi-fashion.com
munixc.info
daas.support
spaceworbc.com
faithtruthresolve.com
gymkub.com
thegrayverse.xyz
artisanmakefurniture.com
029tryy.com
ijuubx.biz
iphone13promax.club
techuniversus.com
samrgov.xyz
grownupcurl.com
sj0755.net
beekeeperkit.com
richessesabondantes.com
xclgjgjh.net
webworkscork.com
vedepviet365.com
bretabeameven.com
cdzsmhw.com
clearperspective.biz
tigrg5g784sh.biz
bbezan011.xyz
mycar.store
mansooralobeidli.com
ascensionmemberszoom.com
unlimitedrehab.com
wozka.top
askylarkgoods.com
rj793.com
prosvalor.com
primetimeexpress.com
boixosnoisperu.com
mmasportgear.com
concertiranian.net
hyponymys.info
maila.one
yti0fyic.xyz
shashiprayag.com
speedprosmotorsports.com
westchestercountyjunkcars.com
patienceinmypocket.com
rausachbaoloc.com
plexregroup.com
outsydercs.com
foodandflour.com
lenacrypto.xyz
homeservicetoday.net
marthaperry.com
vmtcyd4q8.com
shamefulguys.com
loccssol.store
gnarledportra.xyz
042atk.xyz
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1124-57-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1124-58-0x000000000041D430-mapping.dmp xloader behavioral1/memory/624-66-0x0000000000080000-0x00000000000A9000-memory.dmp xloader behavioral1/memory/1792-78-0x000000000041D430-mapping.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
igfx7nm81n.exeigfx7nm81n.exepid process 1872 igfx7nm81n.exe 1792 igfx7nm81n.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 680 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
RFQ#.exeigfx7nm81n.exepid process 320 RFQ#.exe 1872 igfx7nm81n.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
NETSTAT.EXEdescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run NETSTAT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\6L0DZLEHW = "C:\\Program Files (x86)\\Ambs\\igfx7nm81n.exe" NETSTAT.EXE -
Suspicious use of SetThreadContext 4 IoCs
Processes:
RFQ#.exeRFQ#.exeNETSTAT.EXEigfx7nm81n.exedescription pid process target process PID 320 set thread context of 1124 320 RFQ#.exe RFQ#.exe PID 1124 set thread context of 1260 1124 RFQ#.exe Explorer.EXE PID 624 set thread context of 1260 624 NETSTAT.EXE Explorer.EXE PID 1872 set thread context of 1792 1872 igfx7nm81n.exe igfx7nm81n.exe -
Drops file in Program Files directory 2 IoCs
Processes:
NETSTAT.EXEExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Ambs\igfx7nm81n.exe NETSTAT.EXE File created C:\Program Files (x86)\Ambs\igfx7nm81n.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\Ambs\igfx7nm81n.exe nsis_installer_1 C:\Program Files (x86)\Ambs\igfx7nm81n.exe nsis_installer_2 C:\Program Files (x86)\Ambs\igfx7nm81n.exe nsis_installer_1 C:\Program Files (x86)\Ambs\igfx7nm81n.exe nsis_installer_2 C:\Program Files (x86)\Ambs\igfx7nm81n.exe nsis_installer_1 C:\Program Files (x86)\Ambs\igfx7nm81n.exe nsis_installer_2 -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 624 NETSTAT.EXE -
Processes:
NETSTAT.EXEdescription ioc process Key created \Registry\User\S-1-5-21-2955169046-2371869340-1800780948-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
RFQ#.exeNETSTAT.EXEigfx7nm81n.exepid process 1124 RFQ#.exe 1124 RFQ#.exe 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 1792 igfx7nm81n.exe 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RFQ#.exeNETSTAT.EXEpid process 1124 RFQ#.exe 1124 RFQ#.exe 1124 RFQ#.exe 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE 624 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RFQ#.exeNETSTAT.EXEigfx7nm81n.exedescription pid process Token: SeDebugPrivilege 1124 RFQ#.exe Token: SeDebugPrivilege 624 NETSTAT.EXE Token: SeDebugPrivilege 1792 igfx7nm81n.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
RFQ#.exeExplorer.EXENETSTAT.EXEigfx7nm81n.exedescription pid process target process PID 320 wrote to memory of 1124 320 RFQ#.exe RFQ#.exe PID 320 wrote to memory of 1124 320 RFQ#.exe RFQ#.exe PID 320 wrote to memory of 1124 320 RFQ#.exe RFQ#.exe PID 320 wrote to memory of 1124 320 RFQ#.exe RFQ#.exe PID 320 wrote to memory of 1124 320 RFQ#.exe RFQ#.exe PID 320 wrote to memory of 1124 320 RFQ#.exe RFQ#.exe PID 320 wrote to memory of 1124 320 RFQ#.exe RFQ#.exe PID 1260 wrote to memory of 624 1260 Explorer.EXE NETSTAT.EXE PID 1260 wrote to memory of 624 1260 Explorer.EXE NETSTAT.EXE PID 1260 wrote to memory of 624 1260 Explorer.EXE NETSTAT.EXE PID 1260 wrote to memory of 624 1260 Explorer.EXE NETSTAT.EXE PID 624 wrote to memory of 680 624 NETSTAT.EXE cmd.exe PID 624 wrote to memory of 680 624 NETSTAT.EXE cmd.exe PID 624 wrote to memory of 680 624 NETSTAT.EXE cmd.exe PID 624 wrote to memory of 680 624 NETSTAT.EXE cmd.exe PID 624 wrote to memory of 1816 624 NETSTAT.EXE Firefox.exe PID 624 wrote to memory of 1816 624 NETSTAT.EXE Firefox.exe PID 624 wrote to memory of 1816 624 NETSTAT.EXE Firefox.exe PID 624 wrote to memory of 1816 624 NETSTAT.EXE Firefox.exe PID 1260 wrote to memory of 1872 1260 Explorer.EXE igfx7nm81n.exe PID 1260 wrote to memory of 1872 1260 Explorer.EXE igfx7nm81n.exe PID 1260 wrote to memory of 1872 1260 Explorer.EXE igfx7nm81n.exe PID 1260 wrote to memory of 1872 1260 Explorer.EXE igfx7nm81n.exe PID 1872 wrote to memory of 1792 1872 igfx7nm81n.exe igfx7nm81n.exe PID 1872 wrote to memory of 1792 1872 igfx7nm81n.exe igfx7nm81n.exe PID 1872 wrote to memory of 1792 1872 igfx7nm81n.exe igfx7nm81n.exe PID 1872 wrote to memory of 1792 1872 igfx7nm81n.exe igfx7nm81n.exe PID 1872 wrote to memory of 1792 1872 igfx7nm81n.exe igfx7nm81n.exe PID 1872 wrote to memory of 1792 1872 igfx7nm81n.exe igfx7nm81n.exe PID 1872 wrote to memory of 1792 1872 igfx7nm81n.exe igfx7nm81n.exe PID 624 wrote to memory of 1816 624 NETSTAT.EXE Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ#.exe"C:\Users\Admin\AppData\Local\Temp\RFQ#.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ#.exe"C:\Users\Admin\AppData\Local\Temp\RFQ#.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ#.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Ambs\igfx7nm81n.exe"C:\Program Files (x86)\Ambs\igfx7nm81n.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Ambs\igfx7nm81n.exe"C:\Program Files (x86)\Ambs\igfx7nm81n.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Ambs\igfx7nm81n.exeMD5
3838c43e12f0c22ecf9a9a0c1deb1d30
SHA17b9d8e4a093672411f71f1cf6a7fe6803c61773c
SHA256b980dfcce93e9140d8ce71151f2f385026b8cebc195b71055707e1468ad0131b
SHA512f0f860a56500b449b29558dc6e8860ce4441cee2612cc22c7cb9aaf5106062e290e3b3313dd0eef55fe1678791992f0502dbda9d0350110b7f7591853445935c
-
C:\Program Files (x86)\Ambs\igfx7nm81n.exeMD5
3838c43e12f0c22ecf9a9a0c1deb1d30
SHA17b9d8e4a093672411f71f1cf6a7fe6803c61773c
SHA256b980dfcce93e9140d8ce71151f2f385026b8cebc195b71055707e1468ad0131b
SHA512f0f860a56500b449b29558dc6e8860ce4441cee2612cc22c7cb9aaf5106062e290e3b3313dd0eef55fe1678791992f0502dbda9d0350110b7f7591853445935c
-
C:\Program Files (x86)\Ambs\igfx7nm81n.exeMD5
3838c43e12f0c22ecf9a9a0c1deb1d30
SHA17b9d8e4a093672411f71f1cf6a7fe6803c61773c
SHA256b980dfcce93e9140d8ce71151f2f385026b8cebc195b71055707e1468ad0131b
SHA512f0f860a56500b449b29558dc6e8860ce4441cee2612cc22c7cb9aaf5106062e290e3b3313dd0eef55fe1678791992f0502dbda9d0350110b7f7591853445935c
-
C:\Users\Admin\AppData\Local\Temp\z5clatnf9g6dMD5
317d593f910ed0b719655295500a581f
SHA1a918c104f2c38d6192acc4ede5425faa1982aae7
SHA25689dd35343acb959b643d53d0c54258dfe457d6724e7226abfad02fa8b2bf300f
SHA5123818e2f971ed9bec278ec517d689b8fa224d763443556373cc503cf163d4823fbc5620db0c20efd2096e34c1936cddc8a7f1e504bf1c8c6753adf5f70f7be72f
-
\Users\Admin\AppData\Local\Temp\nsdF854.tmp\qdubg.dllMD5
55a776d0472c31ed04059c11c38d7953
SHA1ffaf336496a3f5333eb50347d22f58aa167f6dfe
SHA25619ee07473845faf92de1dc004133078ed730a9ca95a577a0300e9b3a4384a448
SHA5122e221116a744682de53ca10eb9aed09d703ffd19e8140936be98900293eb74fcbb295bc32817b712a7c1ad6d3ea946374b96e0ad758b7c88dbfa15e25a5eb071
-
\Users\Admin\AppData\Local\Temp\nsuECB1.tmp\qdubg.dllMD5
55a776d0472c31ed04059c11c38d7953
SHA1ffaf336496a3f5333eb50347d22f58aa167f6dfe
SHA25619ee07473845faf92de1dc004133078ed730a9ca95a577a0300e9b3a4384a448
SHA5122e221116a744682de53ca10eb9aed09d703ffd19e8140936be98900293eb74fcbb295bc32817b712a7c1ad6d3ea946374b96e0ad758b7c88dbfa15e25a5eb071
-
memory/320-55-0x00000000768A1000-0x00000000768A3000-memory.dmpFilesize
8KB
-
memory/624-66-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/624-65-0x0000000000A00000-0x0000000000A09000-memory.dmpFilesize
36KB
-
memory/624-63-0x0000000000000000-mapping.dmp
-
memory/624-67-0x0000000002190000-0x0000000002493000-memory.dmpFilesize
3.0MB
-
memory/624-68-0x0000000001EA0000-0x0000000001F30000-memory.dmpFilesize
576KB
-
memory/680-64-0x0000000000000000-mapping.dmp
-
memory/1124-60-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/1124-61-0x00000000003D0000-0x00000000003E1000-memory.dmpFilesize
68KB
-
memory/1124-58-0x000000000041D430-mapping.dmp
-
memory/1124-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1260-62-0x0000000006B10000-0x0000000006C85000-memory.dmpFilesize
1.5MB
-
memory/1260-69-0x00000000065B0000-0x0000000006684000-memory.dmpFilesize
848KB
-
memory/1792-78-0x000000000041D430-mapping.dmp
-
memory/1792-80-0x0000000000860000-0x0000000000B63000-memory.dmpFilesize
3.0MB
-
memory/1872-71-0x0000000000000000-mapping.dmp