Analysis
-
max time kernel
112s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-05-2022 14:00
Static task
static1
Behavioral task
behavioral1
Sample
INQNEW#PO24052022.qdf.exe
Resource
win7-20220414-en
General
-
Target
INQNEW#PO24052022.qdf.exe
-
Size
276KB
-
MD5
ebb0fecde4a2e88c63c27c82810113b5
-
SHA1
c5658bec21ea4dfe2d0a66089d2d18bf081c778f
-
SHA256
df1b0eef4f32a5c2527691175375962957db71bc913d37f6e71150e599b2b31c
-
SHA512
05960c717d5f30ca5b1424a3a2806c2a7a00b6ec4a3949bdb7db4d7f5fd885119cf18cbb752537ddcb7bc277ecf683d060c40baee3ac6bdb6f76cb5a50598ad8
Malware Config
Extracted
xloader
2.6
be4o
laboratoriobioixcha.com
tictocperushop.online
wild-oceans.com
belaruscountry.com
kicktmall.com
fitcoinweb.tech
mores.one
gogear.one
gxrcksy.com
samrcq.com
impossible-icecream.com
bravesxx.com
bookchainart.com
sleepsolutionsofmboro.com
ocbrazilbusinessclub.com
advisor76.xyz
xitaotech.com
mgsdtytifgf3414.xyz
johnson-brown.net
cr3drt.com
virtualtourpro.store
transporteriocristal.com
fjbingjiang.com
minecraftrojectx.site
ttrcb.com
sexlarab.com
cxzczc2.online
doorsmm.com
weisbergiegal.com
skythinks.com
schoolsuperaty.com
swampbucketkids.com
networklogicsa.com
businessevs.com
gulfcoastclinicchiro.com
milliards.xyz
moviesquery.com
cycletostack.com
c0wkvo.com
inkingthings.net
cookvillecampgroundvt.com
rajeshprinters.com
binge-bane.biz
ginger9632-voice.cloud
1nfo-post.com
unta.xyz
liuhumu.com
khandaia.info
ha01qnscvts0l.xyz
liert.site
allflowmedia.com
6ibnuj9t.xyz
embravewise.com
responsabilities.com
apexges.com
ola-speechtherapy.com
pristinefarmlands.com
adaraateristiayote.store
journeyhomemeditation.com
96238.top
nosipokip.site
itt-service.com
bw590jumpb.xyz
relieveyourdog.com
qiyeweiiliaoo0428.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4928-134-0x0000000000F40000-0x0000000000F6B000-memory.dmp xloader -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
INQNEW#PO24052022.qdf.exedescription pid process target process PID 912 set thread context of 4928 912 INQNEW#PO24052022.qdf.exe vbc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2412 4928 WerFault.exe vbc.exe 2156 4928 WerFault.exe vbc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
INQNEW#PO24052022.qdf.exedescription pid process target process PID 912 wrote to memory of 4928 912 INQNEW#PO24052022.qdf.exe vbc.exe PID 912 wrote to memory of 4928 912 INQNEW#PO24052022.qdf.exe vbc.exe PID 912 wrote to memory of 4928 912 INQNEW#PO24052022.qdf.exe vbc.exe PID 912 wrote to memory of 4928 912 INQNEW#PO24052022.qdf.exe vbc.exe PID 912 wrote to memory of 4928 912 INQNEW#PO24052022.qdf.exe vbc.exe PID 912 wrote to memory of 4928 912 INQNEW#PO24052022.qdf.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INQNEW#PO24052022.qdf.exe"C:\Users\Admin\AppData\Local\Temp\INQNEW#PO24052022.qdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 1803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 2043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4928 -ip 49281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4928 -ip 49281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/912-130-0x0000000000AC0000-0x0000000000B0A000-memory.dmpFilesize
296KB
-
memory/912-131-0x0000000005970000-0x0000000005F14000-memory.dmpFilesize
5.6MB
-
memory/4928-132-0x0000000000000000-mapping.dmp
-
memory/4928-133-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4928-134-0x0000000000F40000-0x0000000000F6B000-memory.dmpFilesize
172KB