Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 06:31
Static task
static1
Behavioral task
behavioral1
Sample
RFQ#220128.exe
Resource
win7-en-20211208
General
-
Target
RFQ#220128.exe
-
Size
749KB
-
MD5
6d236070946d1a500d0ce9988240975f
-
SHA1
94ada5c3577d58390b252353f3ec9a7fcca49c35
-
SHA256
beccec456cf3e74a220ae1c8fa65cc0f4ddef57bee5d4f2ec71ad7b99da52369
-
SHA512
362e149560e26131d6d00daf1ba7a8bf6f156990bbbb90d8eb3d1a2249277288d109d388046d5cfbc816cd05aaec02d8729d636b340c4ff7f934543b62ba27db
Malware Config
Extracted
xloader
2.5
s9ne
digital-performance-award.com
fioratti.xyz
designluxre.com
cngangdun.com
restaurantperladelmare.com
davinci65.info
glossmans.com
firstsmileimaging.com
indevmobility.biz
mvptcodesupport.com
crustenc.net
raleighsportsacademy.com
boytoyporn.com
rojaspass.com
acmepaysage.fr
shopatdean.xyz
leonergsteve18870.com
elnahuel.com
ils.network
canto-libero.com
bracknellglazingcommercial.com
jordanontheshirts.com
pnwpickleballclub.com
studibucks.com
stevesbbcards.com
pingerton.online
wincrestadvisors.com
fabiulaezeca.com
internationally.info
alianzaporextremadura.com
annianzu.icu
suryaweb.host
uh6or9.com
burceh5.store
herbalmedication.xyz
taiquandao.net
duongkhanglinh.club
endokc.com
fourjuicydeny.com
shengyuantongfs.com
sport-laboratory.com
redesignpain.com
hedefcapitals33.com
nhealthcareservices.online
exodicuis.com
hottubsswimspascoralsprings.com
louiecruzbeltran.info
sherrilyndale.com
ohneulmum.quest
adopteunper.com
windpeople.store
mypagbound.com
cargopremier.com
amichekadota.quest
efootballpro2022.net
jeeaner.com
clasiquitos.com
rockyal.xyz
vnpmhs.com
cnshuanglai.com
ratawatakara.com
stc-ksa.com
happy-bihada.space
flirty-little-secret.com
woodentoysforkids.store
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1304-60-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1820-66-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1148 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RFQ#220128.exeRFQ#220128.exechkdsk.exedescription pid process target process PID 1688 set thread context of 1304 1688 RFQ#220128.exe RFQ#220128.exe PID 1304 set thread context of 1412 1304 RFQ#220128.exe Explorer.EXE PID 1820 set thread context of 1412 1820 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
RFQ#220128.exechkdsk.exepid process 1304 RFQ#220128.exe 1304 RFQ#220128.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe 1820 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RFQ#220128.exechkdsk.exepid process 1304 RFQ#220128.exe 1304 RFQ#220128.exe 1304 RFQ#220128.exe 1820 chkdsk.exe 1820 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ#220128.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1304 RFQ#220128.exe Token: SeDebugPrivilege 1820 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
RFQ#220128.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1688 wrote to memory of 1304 1688 RFQ#220128.exe RFQ#220128.exe PID 1688 wrote to memory of 1304 1688 RFQ#220128.exe RFQ#220128.exe PID 1688 wrote to memory of 1304 1688 RFQ#220128.exe RFQ#220128.exe PID 1688 wrote to memory of 1304 1688 RFQ#220128.exe RFQ#220128.exe PID 1688 wrote to memory of 1304 1688 RFQ#220128.exe RFQ#220128.exe PID 1688 wrote to memory of 1304 1688 RFQ#220128.exe RFQ#220128.exe PID 1688 wrote to memory of 1304 1688 RFQ#220128.exe RFQ#220128.exe PID 1412 wrote to memory of 1820 1412 Explorer.EXE chkdsk.exe PID 1412 wrote to memory of 1820 1412 Explorer.EXE chkdsk.exe PID 1412 wrote to memory of 1820 1412 Explorer.EXE chkdsk.exe PID 1412 wrote to memory of 1820 1412 Explorer.EXE chkdsk.exe PID 1820 wrote to memory of 1148 1820 chkdsk.exe cmd.exe PID 1820 wrote to memory of 1148 1820 chkdsk.exe cmd.exe PID 1820 wrote to memory of 1148 1820 chkdsk.exe cmd.exe PID 1820 wrote to memory of 1148 1820 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1304-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1304-63-0x0000000000210000-0x0000000000221000-memory.dmpFilesize
68KB
-
memory/1304-61-0x0000000000BB0000-0x0000000000EB3000-memory.dmpFilesize
3.0MB
-
memory/1304-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1304-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1412-69-0x0000000006D60000-0x0000000006E5B000-memory.dmpFilesize
1004KB
-
memory/1412-64-0x00000000048E0000-0x0000000004A45000-memory.dmpFilesize
1.4MB
-
memory/1688-57-0x0000000004CB0000-0x0000000004D12000-memory.dmpFilesize
392KB
-
memory/1688-53-0x0000000000AE0000-0x0000000000BA2000-memory.dmpFilesize
776KB
-
memory/1688-56-0x00000000002C0000-0x00000000002CC000-memory.dmpFilesize
48KB
-
memory/1688-55-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/1688-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmpFilesize
8KB
-
memory/1820-65-0x00000000004E0000-0x00000000004E7000-memory.dmpFilesize
28KB
-
memory/1820-66-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1820-67-0x0000000001FF0000-0x00000000022F3000-memory.dmpFilesize
3.0MB
-
memory/1820-68-0x0000000001F00000-0x0000000001F90000-memory.dmpFilesize
576KB