Analysis
- max time kernel
155s - max time network
154s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
27/01/2022, 06:37
General
- Target RFQ.exe
- Size 381KB
- Sample220127-hdgsjaghfk
- SHA256 d4524304e059a341b36dfff67ecfde1832142373d0728956fd8efb079440035f
Malware Config
Extracted
-
xloader
-
2.5
-
oms5
-
stepfantasy.media
-
kentuckyvapeshop.com
-
mod-hotels.com
-
kkstudy.net
-
temanfts.xyz
-
lzcsj.com
-
7808aaa.com
-
1sab.claims
-
yangraclelamb.com
-
tndlz.com
-
lndjg.com
-
scjmzs.com
-
galabet0350.com
-
xn--mobile-bar-mnchen-e3b.com
-
lufkinreign.com
-
beweig.com
-
happygirlxxx.com
-
datapieces.com
-
happysad.store
-
sweet-comforts.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 4 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 51 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DhcwYWSZmJ.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DhcwYWSZmJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7088.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1628-116-0x0000000005260000-0x000000000575E000-memory.dmp
memory/1628-117-0x0000000004D60000-0x0000000004DF2000-memory.dmp
memory/1628-118-0x00000000028E0000-0x00000000028EA000-memory.dmp
memory/1628-119-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/1628-120-0x0000000004EA0000-0x0000000004EAC000-memory.dmp
memory/1628-121-0x0000000007380000-0x000000000741C000-memory.dmp
memory/1628-122-0x0000000007500000-0x0000000007564000-memory.dmp
memory/1628-115-0x00000000003C0000-0x0000000000426000-memory.dmp
memory/3052-137-0x0000000006E40000-0x0000000006F53000-memory.dmp
memory/3052-378-0x00000000072C0000-0x000000000743B000-memory.dmp
memory/3052-368-0x0000000007110000-0x00000000072B1000-memory.dmp
memory/3188-138-0x00000000013C0000-0x00000000016E0000-memory.dmp
memory/3188-136-0x0000000001220000-0x00000000013BC000-memory.dmp
memory/3188-127-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3188-367-0x0000000001220000-0x00000000013BC000-memory.dmp
memory/3188-366-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4316-151-0x0000000008F70000-0x0000000008F8E000-memory.dmp
memory/4316-158-0x000000007EDF0000-0x000000007EDF1000-memory.dmp
memory/4316-129-0x0000000006E30000-0x0000000006E52000-memory.dmp
memory/4316-128-0x0000000007080000-0x00000000076A8000-memory.dmp
memory/4316-139-0x0000000007BC0000-0x0000000007BDC000-memory.dmp
memory/4316-140-0x0000000007F80000-0x0000000007FCB000-memory.dmp
memory/4316-141-0x0000000007E50000-0x0000000007EC6000-memory.dmp
memory/4316-150-0x0000000008F90000-0x0000000008FC3000-memory.dmp
memory/4316-130-0x0000000006FD0000-0x0000000007036000-memory.dmp
memory/4316-156-0x00000000090D0000-0x0000000009175000-memory.dmp
memory/4316-157-0x00000000092B0000-0x0000000009344000-memory.dmp
memory/4316-133-0x00000000011C0000-0x00000000011C1000-memory.dmp
memory/4316-159-0x00000000011C3000-0x00000000011C4000-memory.dmp
memory/4316-352-0x0000000009240000-0x000000000925A000-memory.dmp
memory/4316-357-0x0000000009230000-0x0000000009238000-memory.dmp
memory/4316-135-0x00000000011C2000-0x00000000011C3000-memory.dmp
memory/4316-132-0x00000000077F0000-0x0000000007B40000-memory.dmp
memory/4316-131-0x0000000007780000-0x00000000077E6000-memory.dmp
memory/4316-125-0x0000000000F50000-0x0000000000F86000-memory.dmp
memory/4760-375-0x0000000000F30000-0x0000000000F59000-memory.dmp
memory/4760-376-0x0000000004FF0000-0x0000000005310000-memory.dmp
memory/4760-377-0x0000000004CC0000-0x0000000004E4D000-memory.dmp
memory/4760-374-0x0000000000FD0000-0x0000000000FF7000-memory.dmp