Analysis
- max time kernel
4294211s - max time network
151s - platform
windows7_x64 - resource
win7-20220223-en - submitted
25/02/2022, 10:29
General
- Target RFQ ZHANGHAOBO CO.,LTD.exe
- Size 1.0MB
- Sample220225-mh85sshbdq
- SHA256 d63af956dec05f8f8f440cc6feedb7d8045cbe0c2953eae0c9e612af8451c57c
Malware Config
Extracted
-
xloader
-
2.5
-
iepw
-
isabellechiritoiabogada.com
-
singaporeimpact.com
-
mdcxdgkr.com
-
fivestasrelectriccorp.com
-
apaspaa.com
-
datashen.com
-
yh2.space
-
remediationnews.com
-
randlesrice.com
-
mailclic.digital
-
n83a.com
-
wmeacc.com
-
cahuvoa.xyz
-
h0t-now.com
-
admtrans.com
-
yghdlhax.xyz
-
bakshipping.com
-
ambermariemusic.com
-
mandelbot.tech
-
cryptoassetmanager.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ ZHANGHAOBO CO.,LTD.exe"C:\Users\Admin\AppData\Local\Temp\RFQ ZHANGHAOBO CO.,LTD.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dfrgui.exe"C:\Windows\SysWOW64\dfrgui.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\dfrgui.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/588-61-0x0000000000400000-0x0000000000445000-memory.dmp
memory/588-64-0x0000000000720000-0x0000000000A23000-memory.dmp
memory/588-65-0x000000000041D000-0x000000000041E000-memory.dmp
memory/588-66-0x0000000000260000-0x0000000000271000-memory.dmp
memory/588-58-0x0000000000400000-0x0000000000445000-memory.dmp
memory/588-59-0x0000000000400000-0x0000000000445000-memory.dmp
memory/588-60-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1220-67-0x0000000004A60000-0x0000000004B8A000-memory.dmp
memory/1220-73-0x00000000041C0000-0x00000000042A6000-memory.dmp
memory/1668-68-0x00000000759B1000-0x00000000759B3000-memory.dmp
memory/1668-69-0x0000000000180000-0x000000000019F000-memory.dmp
memory/1668-70-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1668-71-0x0000000001F40000-0x0000000002243000-memory.dmp
memory/1668-72-0x0000000001D40000-0x0000000001DD0000-memory.dmp
memory/1932-62-0x00000000048B0000-0x00000000048B1000-memory.dmp
memory/1932-57-0x00000000007D0000-0x00000000007FC000-memory.dmp
memory/1932-56-0x00000000047F0000-0x00000000048B0000-memory.dmp
memory/1932-55-0x00000000744AE000-0x00000000744AF000-memory.dmp
memory/1932-54-0x0000000001010000-0x0000000001118000-memory.dmp