Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 06:31
Static task
static1
Behavioral task
behavioral1
Sample
RFQ#220128.exe
Resource
win7-en-20211208
General
-
Target
RFQ#220128.exe
-
Size
749KB
-
MD5
6d236070946d1a500d0ce9988240975f
-
SHA1
94ada5c3577d58390b252353f3ec9a7fcca49c35
-
SHA256
beccec456cf3e74a220ae1c8fa65cc0f4ddef57bee5d4f2ec71ad7b99da52369
-
SHA512
362e149560e26131d6d00daf1ba7a8bf6f156990bbbb90d8eb3d1a2249277288d109d388046d5cfbc816cd05aaec02d8729d636b340c4ff7f934543b62ba27db
Malware Config
Extracted
xloader
2.5
s9ne
digital-performance-award.com
fioratti.xyz
designluxre.com
cngangdun.com
restaurantperladelmare.com
davinci65.info
glossmans.com
firstsmileimaging.com
indevmobility.biz
mvptcodesupport.com
crustenc.net
raleighsportsacademy.com
boytoyporn.com
rojaspass.com
acmepaysage.fr
shopatdean.xyz
leonergsteve18870.com
elnahuel.com
ils.network
canto-libero.com
bracknellglazingcommercial.com
jordanontheshirts.com
pnwpickleballclub.com
studibucks.com
stevesbbcards.com
pingerton.online
wincrestadvisors.com
fabiulaezeca.com
internationally.info
alianzaporextremadura.com
annianzu.icu
suryaweb.host
uh6or9.com
burceh5.store
herbalmedication.xyz
taiquandao.net
duongkhanglinh.club
endokc.com
fourjuicydeny.com
shengyuantongfs.com
sport-laboratory.com
redesignpain.com
hedefcapitals33.com
nhealthcareservices.online
exodicuis.com
hottubsswimspascoralsprings.com
louiecruzbeltran.info
sherrilyndale.com
ohneulmum.quest
adopteunper.com
windpeople.store
mypagbound.com
cargopremier.com
amichekadota.quest
efootballpro2022.net
jeeaner.com
clasiquitos.com
rockyal.xyz
vnpmhs.com
cnshuanglai.com
ratawatakara.com
stc-ksa.com
happy-bihada.space
flirty-little-secret.com
woodentoysforkids.store
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1220-123-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1220-126-0x0000000001410000-0x000000000155A000-memory.dmp xloader behavioral2/memory/2852-129-0x0000000000DA0000-0x0000000000DC9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RFQ#220128.exeRFQ#220128.exewscript.exedescription pid process target process PID 2760 set thread context of 1220 2760 RFQ#220128.exe RFQ#220128.exe PID 1220 set thread context of 3000 1220 RFQ#220128.exe Explorer.EXE PID 2852 set thread context of 3000 2852 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
RFQ#220128.exeRFQ#220128.exewscript.exepid process 2760 RFQ#220128.exe 2760 RFQ#220128.exe 1220 RFQ#220128.exe 1220 RFQ#220128.exe 1220 RFQ#220128.exe 1220 RFQ#220128.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe 2852 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3000 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RFQ#220128.exewscript.exepid process 1220 RFQ#220128.exe 1220 RFQ#220128.exe 1220 RFQ#220128.exe 2852 wscript.exe 2852 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RFQ#220128.exeRFQ#220128.exewscript.exedescription pid process Token: SeDebugPrivilege 2760 RFQ#220128.exe Token: SeDebugPrivilege 1220 RFQ#220128.exe Token: SeDebugPrivilege 2852 wscript.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
RFQ#220128.exeExplorer.EXEwscript.exedescription pid process target process PID 2760 wrote to memory of 1252 2760 RFQ#220128.exe RFQ#220128.exe PID 2760 wrote to memory of 1252 2760 RFQ#220128.exe RFQ#220128.exe PID 2760 wrote to memory of 1252 2760 RFQ#220128.exe RFQ#220128.exe PID 2760 wrote to memory of 1220 2760 RFQ#220128.exe RFQ#220128.exe PID 2760 wrote to memory of 1220 2760 RFQ#220128.exe RFQ#220128.exe PID 2760 wrote to memory of 1220 2760 RFQ#220128.exe RFQ#220128.exe PID 2760 wrote to memory of 1220 2760 RFQ#220128.exe RFQ#220128.exe PID 2760 wrote to memory of 1220 2760 RFQ#220128.exe RFQ#220128.exe PID 2760 wrote to memory of 1220 2760 RFQ#220128.exe RFQ#220128.exe PID 3000 wrote to memory of 2852 3000 Explorer.EXE wscript.exe PID 3000 wrote to memory of 2852 3000 Explorer.EXE wscript.exe PID 3000 wrote to memory of 2852 3000 Explorer.EXE wscript.exe PID 2852 wrote to memory of 1632 2852 wscript.exe cmd.exe PID 2852 wrote to memory of 1632 2852 wscript.exe cmd.exe PID 2852 wrote to memory of 1632 2852 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ#220128.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1220-123-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1220-126-0x0000000001410000-0x000000000155A000-memory.dmpFilesize
1.3MB
-
memory/1220-125-0x0000000001940000-0x0000000001C60000-memory.dmpFilesize
3.1MB
-
memory/2760-119-0x00000000051D0000-0x00000000051DA000-memory.dmpFilesize
40KB
-
memory/2760-116-0x0000000005590000-0x0000000005A8E000-memory.dmpFilesize
5.0MB
-
memory/2760-120-0x0000000005560000-0x000000000556C000-memory.dmpFilesize
48KB
-
memory/2760-121-0x0000000007B10000-0x0000000007BAC000-memory.dmpFilesize
624KB
-
memory/2760-122-0x0000000007C90000-0x0000000007CF2000-memory.dmpFilesize
392KB
-
memory/2760-118-0x0000000005090000-0x000000000558E000-memory.dmpFilesize
5.0MB
-
memory/2760-117-0x0000000005130000-0x00000000051C2000-memory.dmpFilesize
584KB
-
memory/2760-115-0x0000000000810000-0x00000000008D2000-memory.dmpFilesize
776KB
-
memory/2852-129-0x0000000000DA0000-0x0000000000DC9000-memory.dmpFilesize
164KB
-
memory/2852-128-0x00000000010F0000-0x0000000001117000-memory.dmpFilesize
156KB
-
memory/2852-130-0x0000000003530000-0x0000000005420000-memory.dmpFilesize
30.9MB
-
memory/2852-131-0x0000000004F70000-0x0000000005100000-memory.dmpFilesize
1.6MB
-
memory/3000-127-0x0000000005880000-0x0000000005994000-memory.dmpFilesize
1.1MB
-
memory/3000-132-0x0000000003420000-0x00000000034BF000-memory.dmpFilesize
636KB