Analysis
-
max time kernel
148s -
max time network
172s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-10-2021 14:37
Static task
static1
Behavioral task
behavioral1
Sample
RFQ#.exe
Resource
win7-en-20210920
General
-
Target
RFQ#.exe
-
Size
296KB
-
MD5
3838c43e12f0c22ecf9a9a0c1deb1d30
-
SHA1
7b9d8e4a093672411f71f1cf6a7fe6803c61773c
-
SHA256
b980dfcce93e9140d8ce71151f2f385026b8cebc195b71055707e1468ad0131b
-
SHA512
f0f860a56500b449b29558dc6e8860ce4441cee2612cc22c7cb9aaf5106062e290e3b3313dd0eef55fe1678791992f0502dbda9d0350110b7f7591853445935c
Malware Config
Extracted
xloader
2.5
unzn
http://www.davanamays.com/unzn/
xiulf.com
highcountrymortar.com
523561.com
marketingagency.tools
ganmovie.net
nationaalcontactpunt.com
sirrbter.com
begizas.xyz
missimi-fashion.com
munixc.info
daas.support
spaceworbc.com
faithtruthresolve.com
gymkub.com
thegrayverse.xyz
artisanmakefurniture.com
029tryy.com
ijuubx.biz
iphone13promax.club
techuniversus.com
samrgov.xyz
grownupcurl.com
sj0755.net
beekeeperkit.com
richessesabondantes.com
xclgjgjh.net
webworkscork.com
vedepviet365.com
bretabeameven.com
cdzsmhw.com
clearperspective.biz
tigrg5g784sh.biz
bbezan011.xyz
mycar.store
mansooralobeidli.com
ascensionmemberszoom.com
unlimitedrehab.com
wozka.top
askylarkgoods.com
rj793.com
prosvalor.com
primetimeexpress.com
boixosnoisperu.com
mmasportgear.com
concertiranian.net
hyponymys.info
maila.one
yti0fyic.xyz
shashiprayag.com
speedprosmotorsports.com
westchestercountyjunkcars.com
patienceinmypocket.com
rausachbaoloc.com
plexregroup.com
outsydercs.com
foodandflour.com
lenacrypto.xyz
homeservicetoday.net
marthaperry.com
vmtcyd4q8.com
shamefulguys.com
loccssol.store
gnarledportra.xyz
042atk.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/560-56-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/560-57-0x000000000041D430-mapping.dmp xloader behavioral1/memory/560-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/788-67-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1072 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
RFQ#.exepid process 1408 RFQ#.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
RFQ#.exeRFQ#.exewininit.exedescription pid process target process PID 1408 set thread context of 560 1408 RFQ#.exe RFQ#.exe PID 560 set thread context of 1336 560 RFQ#.exe Explorer.EXE PID 560 set thread context of 1336 560 RFQ#.exe Explorer.EXE PID 788 set thread context of 1336 788 wininit.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
RFQ#.exewininit.exepid process 560 RFQ#.exe 560 RFQ#.exe 560 RFQ#.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe 788 wininit.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RFQ#.exewininit.exepid process 560 RFQ#.exe 560 RFQ#.exe 560 RFQ#.exe 560 RFQ#.exe 788 wininit.exe 788 wininit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ#.exewininit.exedescription pid process Token: SeDebugPrivilege 560 RFQ#.exe Token: SeDebugPrivilege 788 wininit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
RFQ#.exeExplorer.EXEwininit.exedescription pid process target process PID 1408 wrote to memory of 560 1408 RFQ#.exe RFQ#.exe PID 1408 wrote to memory of 560 1408 RFQ#.exe RFQ#.exe PID 1408 wrote to memory of 560 1408 RFQ#.exe RFQ#.exe PID 1408 wrote to memory of 560 1408 RFQ#.exe RFQ#.exe PID 1408 wrote to memory of 560 1408 RFQ#.exe RFQ#.exe PID 1408 wrote to memory of 560 1408 RFQ#.exe RFQ#.exe PID 1408 wrote to memory of 560 1408 RFQ#.exe RFQ#.exe PID 1336 wrote to memory of 788 1336 Explorer.EXE wininit.exe PID 1336 wrote to memory of 788 1336 Explorer.EXE wininit.exe PID 1336 wrote to memory of 788 1336 Explorer.EXE wininit.exe PID 1336 wrote to memory of 788 1336 Explorer.EXE wininit.exe PID 788 wrote to memory of 1072 788 wininit.exe cmd.exe PID 788 wrote to memory of 1072 788 wininit.exe cmd.exe PID 788 wrote to memory of 1072 788 wininit.exe cmd.exe PID 788 wrote to memory of 1072 788 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ#.exe"C:\Users\Admin\AppData\Local\Temp\RFQ#.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ#.exe"C:\Users\Admin\AppData\Local\Temp\RFQ#.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ#.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsy2991.tmp\qdubg.dllMD5
55a776d0472c31ed04059c11c38d7953
SHA1ffaf336496a3f5333eb50347d22f58aa167f6dfe
SHA25619ee07473845faf92de1dc004133078ed730a9ca95a577a0300e9b3a4384a448
SHA5122e221116a744682de53ca10eb9aed09d703ffd19e8140936be98900293eb74fcbb295bc32817b712a7c1ad6d3ea946374b96e0ad758b7c88dbfa15e25a5eb071
-
memory/560-63-0x00000000003A0000-0x00000000003B1000-memory.dmpFilesize
68KB
-
memory/560-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/560-57-0x000000000041D430-mapping.dmp
-
memory/560-60-0x00000000002C0000-0x00000000002D1000-memory.dmpFilesize
68KB
-
memory/560-59-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/560-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/788-66-0x0000000000E40000-0x0000000000E5A000-memory.dmpFilesize
104KB
-
memory/788-65-0x0000000000000000-mapping.dmp
-
memory/788-67-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/788-69-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/788-70-0x00000000008B0000-0x0000000000940000-memory.dmpFilesize
576KB
-
memory/1072-68-0x0000000000000000-mapping.dmp
-
memory/1336-61-0x00000000068F0000-0x0000000006A5A000-memory.dmpFilesize
1.4MB
-
memory/1336-64-0x0000000007050000-0x00000000071DF000-memory.dmpFilesize
1.6MB
-
memory/1336-71-0x0000000004A20000-0x0000000004ACE000-memory.dmpFilesize
696KB
-
memory/1408-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB