Overview

overview

10

Static

static

1

bunker inq...21.exe

windows7_x64

10

bunker inq...21.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bunker inquiry_020100121.exe

  • Size

    272KB

  • Sample

    220117-d6gk1sghcl

  • MD5

    d700d80487e10f8b9ea5fb50b9e9109c

  • SHA1

    9177a19d76b09d4cde071a07ffb626c9bd4e3652

  • SHA256

    16e137fca9b2bc45254218e2c5f19c2c3b74ec6e4454706bcfd4454a6472c33c

  • SHA512

    e27bf0d76d02b2ccd90d30d94cb94d1549f920fb9fcbf31b0ce13131cd6ff7465a08515469414214d23a26cb7474b7f9a9749c2be88a51458768f8cd429c9a40

Score
10/10
formbookxloaderigwaloaderpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

igwa

Decoy

listingswithalex.com

funtabse.com

aydenwalling.com

prochal.net

superfoodsnederland.com

moldluck.com

dianekgordon.store

regionalhomescommercial.com

mysecuritymadesimple.com

malwaremastery.com

kodaikeiko.com

jrzg996.com

agricurve.net

songlingjiu.com

virginianundahfishingclub.com

friendschance.com

pastelpresents.com

answertitles.com

survival-hunter.com

nxfddl.com

Targets

    • Target

      bunker inquiry_020100121.exe

    • Size

      272KB

    • MD5

      d700d80487e10f8b9ea5fb50b9e9109c

    • SHA1

      9177a19d76b09d4cde071a07ffb626c9bd4e3652

    • SHA256

      16e137fca9b2bc45254218e2c5f19c2c3b74ec6e4454706bcfd4454a6472c33c

    • SHA512

      e27bf0d76d02b2ccd90d30d94cb94d1549f920fb9fcbf31b0ce13131cd6ff7465a08515469414214d23a26cb7474b7f9a9749c2be88a51458768f8cd429c9a40

    Score
    10/10
    xloaderigwaloaderratsuricataformbookpersistencespywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks