Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
25/02/2022, 10:29
Static task
static1
Behavioral task
behavioral1
Sample
RFQ ZHANGHAOBO CO.,LTD.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
General
- Target RFQ ZHANGHAOBO CO.,LTD.exe
- Size 1.0MB
- Sample220225-mh85sshbdq
- SHA256 d63af956dec05f8f8f440cc6feedb7d8045cbe0c2953eae0c9e612af8451c57c
- MD5 8985a7f3ac0a252c443d06d5e07c89c3
- SHA1 a853194afcd05e2a485bbe149e83fe716d72cbc3
- SHA512 f4be4ac2ef2ea50589040ac1790dfa9bcc43217f850dd427e2021943fb511253e7137e3f1868daf34004e5759fd007b8e3fff9291e33ead26077042d7d3b66ba
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
iepw
Decoy
-
isabellechiritoiabogada.com
-
singaporeimpact.com
-
mdcxdgkr.com
-
fivestasrelectriccorp.com
-
apaspaa.com
-
datashen.com
-
yh2.space
-
remediationnews.com
-
randlesrice.com
-
mailclic.digital
-
n83a.com
-
wmeacc.com
-
cahuvoa.xyz
-
h0t-now.com
-
admtrans.com
-
yghdlhax.xyz
-
bakshipping.com
-
ambermariemusic.com
-
mandelbot.tech
-
cryptoassetmanager.xyz
-
navientrefinancing.com
-
xn--12c1cybcl4e.com
-
keysthatrock.com
-
shristiprintingplaces.com
-
bootychaserlinkedbingo.com
-
shebreaks.vegas
-
theadvocatingalmostattorney.com
-
mingyuan.men
-
bossila.store
-
mirceacuza.com
-
vcfnc.com
-
gamefi-giveaway.com
-
loveseaton.com
-
zcaerialdronecoverage.com
-
side-clicks.com
-
tavaresmelodia.com
-
edc10.com
-
moonfoxflow.club
-
sattaking-gaziabad.xyz
-
bharathjbaiju.com
-
drawapp.net
-
034655858.com
-
windrowysxqtn.xyz
-
upposeidonmax.net
-
phoebenfinn.com
-
getmusicheard.com
-
skyzed.com
-
worldcoachesnetwork.com
-
industrialrocketlamp.com
-
pontrenmutu.com
-
classiclord.com
-
cronamovement.com
-
carforsells.com
-
batuhanasut.com
-
obujieitel.quest
-
quimicosypapelesdelnte.com
-
szb6.com
-
handwerks-service.com
-
englishster.com
-
duncharis.com
-
dealsforsuvsil.com
-
heicensus.xyz
-
excellglobus.com
-
halkn.xyz
-
blue-chipwordtoscan-today.info
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/4692-134-0x0000000000400000-0x0000000000445000-memory.dmp xloader behavioral2/memory/4692-136-0x0000000000400000-0x0000000000445000-memory.dmp xloader behavioral2/memory/4408-142-0x0000000000900000-0x0000000000929000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3876 set thread context of 4692 3876 RFQ ZHANGHAOBO CO.,LTD.exe 82 PID 4692 set thread context of 992 4692 fontview.exe 52 PID 4408 set thread context of 992 4408 wscript.exe 52 - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3876 RFQ ZHANGHAOBO CO.,LTD.exe 3876 RFQ ZHANGHAOBO CO.,LTD.exe 3876 RFQ ZHANGHAOBO CO.,LTD.exe 3876 RFQ ZHANGHAOBO CO.,LTD.exe 3876 RFQ ZHANGHAOBO CO.,LTD.exe 3876 RFQ ZHANGHAOBO CO.,LTD.exe 3876 RFQ ZHANGHAOBO CO.,LTD.exe 3876 RFQ ZHANGHAOBO CO.,LTD.exe 4692 fontview.exe 4692 fontview.exe 4692 fontview.exe 4692 fontview.exe 3876 RFQ ZHANGHAOBO CO.,LTD.exe 3876 RFQ ZHANGHAOBO CO.,LTD.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe 4408 wscript.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 992 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4692 fontview.exe 4692 fontview.exe 4692 fontview.exe 4408 wscript.exe 4408 wscript.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3876 RFQ ZHANGHAOBO CO.,LTD.exe Token: SeDebugPrivilege 4692 fontview.exe Token: SeDebugPrivilege 4408 wscript.exe Token: SeShutdownPrivilege 992 Explorer.EXE Token: SeCreatePagefilePrivilege 992 Explorer.EXE Token: SeShutdownPrivilege 992 Explorer.EXE Token: SeCreatePagefilePrivilege 992 Explorer.EXE Token: SeShutdownPrivilege 992 Explorer.EXE Token: SeCreatePagefilePrivilege 992 Explorer.EXE Token: SeShutdownPrivilege 992 Explorer.EXE Token: SeCreatePagefilePrivilege 992 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 992 Explorer.EXE - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3876 wrote to memory of 4692 3876 RFQ ZHANGHAOBO CO.,LTD.exe 82 PID 3876 wrote to memory of 4692 3876 RFQ ZHANGHAOBO CO.,LTD.exe 82 PID 3876 wrote to memory of 4692 3876 RFQ ZHANGHAOBO CO.,LTD.exe 82 PID 3876 wrote to memory of 4692 3876 RFQ ZHANGHAOBO CO.,LTD.exe 82 PID 3876 wrote to memory of 4692 3876 RFQ ZHANGHAOBO CO.,LTD.exe 82 PID 3876 wrote to memory of 4692 3876 RFQ ZHANGHAOBO CO.,LTD.exe 82 PID 3876 wrote to memory of 4692 3876 RFQ ZHANGHAOBO CO.,LTD.exe 82 PID 992 wrote to memory of 4408 992 Explorer.EXE 83 PID 992 wrote to memory of 4408 992 Explorer.EXE 83 PID 992 wrote to memory of 4408 992 Explorer.EXE 83 PID 4408 wrote to memory of 212 4408 wscript.exe 91 PID 4408 wrote to memory of 212 4408 wscript.exe 91 PID 4408 wrote to memory of 212 4408 wscript.exe 91
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\RFQ ZHANGHAOBO CO.,LTD.exe"C:\Users\Admin\AppData\Local\Temp\RFQ ZHANGHAOBO CO.,LTD.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\fontview.exe"C:\Windows\SysWOW64\fontview.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\fontview.exe"3⤵PID:212
-
-