Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
22/12/2021, 09:09
General
- Target RFQ.exe
- Size 435KB
- Sample211222-k4htmafbf4
- SHA256 cc4478165b692f7109f252816f64a1fbb9cbf32c0ff623a255d2c9cd235a2da8
Malware Config
Extracted
-
xloader
-
2.5
-
gnui
-
himalayanwanderwoods.com
-
finvi.guru
-
iphone13promax.show
-
rpfcomunicacao.com
-
inemilia.com
-
blboutiqueexchange.com
-
sukiller.com
-
tzwa.net
-
noemiklein.com
-
upscalepklptp.xyz
-
unboxk.com
-
greatamericanlandworks.com
-
bataperu.com
-
estebanacostapeugeot.com
-
gombc-a02.com
-
642541.com
-
13f465.com
-
jskswj.com
-
hibar.xyz
-
eltool.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/952-54-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/952-56-0x00000000756C1000-0x00000000756C3000-memory.dmp
memory/952-57-0x0000000004320000-0x0000000004321000-memory.dmp
memory/952-58-0x0000000000300000-0x0000000000308000-memory.dmp
memory/952-59-0x0000000005B90000-0x0000000005BE8000-memory.dmp
memory/1220-74-0x0000000004AE0000-0x0000000004B9C000-memory.dmp
memory/1220-67-0x0000000007570000-0x0000000007708000-memory.dmp
memory/1504-65-0x0000000000BD0000-0x0000000000ED3000-memory.dmp
memory/1504-66-0x0000000000140000-0x0000000000151000-memory.dmp
memory/1504-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1504-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1504-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1872-70-0x0000000000FF0000-0x0000000001006000-memory.dmp
memory/1872-71-0x0000000000100000-0x0000000000129000-memory.dmp
memory/1872-72-0x0000000000A10000-0x0000000000D13000-memory.dmp
memory/1872-73-0x0000000000480000-0x0000000000510000-memory.dmp