Analysis
- max time kernel
150s - max time network
154s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
22/12/2021, 09:09
General
- Target RFQ.exe
- Size 435KB
- Sample211222-k4htmafbf4
- SHA256 cc4478165b692f7109f252816f64a1fbb9cbf32c0ff623a255d2c9cd235a2da8
Malware Config
Extracted
-
xloader
-
2.5
-
gnui
-
himalayanwanderwoods.com
-
finvi.guru
-
iphone13promax.show
-
rpfcomunicacao.com
-
inemilia.com
-
blboutiqueexchange.com
-
sukiller.com
-
tzwa.net
-
noemiklein.com
-
upscalepklptp.xyz
-
unboxk.com
-
greatamericanlandworks.com
-
bataperu.com
-
estebanacostapeugeot.com
-
gombc-a02.com
-
642541.com
-
13f465.com
-
jskswj.com
-
hibar.xyz
-
eltool.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/372-125-0x0000000000400000-0x0000000000429000-memory.dmp
memory/372-128-0x0000000001720000-0x0000000001A40000-memory.dmp
memory/372-129-0x0000000001280000-0x0000000001291000-memory.dmp
memory/2052-133-0x0000000000740000-0x0000000000769000-memory.dmp
memory/2052-136-0x0000000002EC0000-0x0000000002F50000-memory.dmp
memory/2052-135-0x0000000003060000-0x0000000003380000-memory.dmp
memory/2052-132-0x0000000000860000-0x0000000000867000-memory.dmp
memory/3036-130-0x0000000004F70000-0x00000000050D9000-memory.dmp
memory/3036-137-0x0000000005E70000-0x0000000005F83000-memory.dmp
memory/3536-117-0x0000000005000000-0x0000000005001000-memory.dmp
memory/3536-118-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/3536-119-0x0000000004B00000-0x0000000004FFE000-memory.dmp
memory/3536-115-0x0000000000270000-0x0000000000271000-memory.dmp
memory/3536-120-0x0000000004B20000-0x0000000004B21000-memory.dmp
memory/3536-121-0x0000000008170000-0x0000000008171000-memory.dmp
memory/3536-124-0x00000000085F0000-0x0000000008648000-memory.dmp
memory/3536-123-0x00000000080E0000-0x00000000080E1000-memory.dmp
memory/3536-122-0x0000000004EE0000-0x0000000004EE8000-memory.dmp