Analysis

  • max time kernel
    154s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    11-02-2022 18:02

General

  • Target

    TW0091.xlsx

  • Size

    187KB

  • MD5

    41521b74c54998dcd1460d444b07c5f1

  • SHA1

    29dcf07f9964a0c2a36defa2935441f559fe7cd2

  • SHA256

    91cf449506a9c3ade639027f6a38e99ee22d9cc7c2a1c4bc42fc8047185b8918

  • SHA512

    8841ddad3690fb1c1436331b03ac26a356f0ff32ab5df923770da4af94785ee5d73cf0f68367cdb2bd3c31922f8be8726004e737753b11c9b32959f71155466d

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b80i

Decoy

junkremovallawrencevillega.com

almihdar.com

libertymarket.net

daxvip.com

smartxbusinessnetwork.com

aanhanger-verhuur.com

nigerianspecialtyfoods.com

springeqx.com

jmwimpactrecovery.com

teamindus.net

cannabisconnecticut.net

50mpt.xyz

southstarfenceny.com

allisonwinterdesign.com

appsforbusiness.pro

rampi6.com

dusa.codes

firstclassrealtynj.com

curativecarnivore.com

verzeker.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload ⋅ 2 IoCs
  • Blocklisted process makes network request ⋅ 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 3 IoCs
  • Loads dropped DLL ⋅ 5 IoCs
  • Uses the VBS compiler for execution ⋅ 1 TTPs
  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext ⋅ 3 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer ⋅ 10 IoCs
  • Enumerates system info in registry ⋅ 2 TTPs 1 IoCs
  • Launches Equation Editor ⋅ 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings ⋅ 1 TTPs 32 IoCs
  • Modifies registry class ⋅ 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 27 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 7 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 9 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 2 IoCs
  • Suspicious use of SendNotifyMessage ⋅ 2 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 3 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 24 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\TW0091.xlsx
      Enumerates system info in registry
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of SetWindowsHookEx
      PID:1624
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      Suspicious use of SetThreadContext
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        PID:1712
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    Blocklisted process makes network request
    Loads dropped DLL
    Launches Equation Editor
    Suspicious use of WriteProcessMemory
    PID:360
    • C:\Users\Public\vbc.exe
      "C:\Users\Public\vbc.exe"
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Users\Admin\AppData\Local\Temp\lzxupx.exe
        C:\Users\Admin\AppData\Local\Temp\lzxupx.exe C:\Users\Admin\AppData\Local\Temp\mhwrt
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        PID:808
        • C:\Users\Admin\AppData\Local\Temp\lzxupx.exe
          C:\Users\Admin\AppData\Local\Temp\lzxupx.exe C:\Users\Admin\AppData\Local\Temp\mhwrt
          Executes dropped EXE
          Suspicious use of SetThreadContext
          Suspicious behavior: EnumeratesProcesses
          Suspicious behavior: MapViewOfSection
          Suspicious use of AdjustPrivilegeToken
          PID:636

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Privilege Escalation

                  Replay Monitor

                  00:00 00:00

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\8yhm36shrfdb7m
                    MD5

                    9a27c7a81f8c8e76ab1428272cbc4822

                    SHA1

                    d7b462d5656f7fd4b84459b3059a2bed605959c3

                    SHA256

                    d3e245fa239555efb9dda0f08a6f446196b815eec04bdb4080c1f07457ddc40f

                    SHA512

                    47b1b4d66c9e9a6e64d174675c4ef7e850fe4de63e32873bd1e2d13d4e3f1cfdb081e95b729f7e2fba0d9755bc78aeac70391e88f3a604895462f2a1e1afd8f1

                  • C:\Users\Admin\AppData\Local\Temp\lzxupx.exe
                    MD5

                    12c84e3b91a0d7b34b8dec119629f515

                    SHA1

                    201d94893c58230d20cd33a18a1e44ee0c1cae60

                    SHA256

                    de9764977cb43f68e1ece123bea4c000963dd89d65f8c8bdfcc471809fe6828e

                    SHA512

                    0ce22f490865b1f733a79393eae96545b91892c21563d9657d01496579db61a9303fed92cbf5b4069f445525ab87b18870195d55d3bd680ec22c842daf989364

                  • C:\Users\Admin\AppData\Local\Temp\lzxupx.exe
                    MD5

                    12c84e3b91a0d7b34b8dec119629f515

                    SHA1

                    201d94893c58230d20cd33a18a1e44ee0c1cae60

                    SHA256

                    de9764977cb43f68e1ece123bea4c000963dd89d65f8c8bdfcc471809fe6828e

                    SHA512

                    0ce22f490865b1f733a79393eae96545b91892c21563d9657d01496579db61a9303fed92cbf5b4069f445525ab87b18870195d55d3bd680ec22c842daf989364

                  • C:\Users\Admin\AppData\Local\Temp\lzxupx.exe
                    MD5

                    12c84e3b91a0d7b34b8dec119629f515

                    SHA1

                    201d94893c58230d20cd33a18a1e44ee0c1cae60

                    SHA256

                    de9764977cb43f68e1ece123bea4c000963dd89d65f8c8bdfcc471809fe6828e

                    SHA512

                    0ce22f490865b1f733a79393eae96545b91892c21563d9657d01496579db61a9303fed92cbf5b4069f445525ab87b18870195d55d3bd680ec22c842daf989364

                  • C:\Users\Admin\AppData\Local\Temp\mhwrt
                    MD5

                    bb58be1427701790f21c1c4655ae8e3b

                    SHA1

                    f218f0d96cb6e4db020e3fb88b6630ad54015572

                    SHA256

                    b9d922099d97de8220ff4ef871c87e68974d72b1e2a82a24cc12af8921f05857

                    SHA512

                    dd2b565684a89d3835989db01fec3416b09e4e8e37831fa62c311ed16659767e4947514f782870d039450786bb25cffedf8936bc94f8078df490c2e3efcc1dec

                  • C:\Users\Public\vbc.exe
                    MD5

                    db601737341d075854a7a92dcfe2c9f9

                    SHA1

                    16b3755c07814422eb01664b67370e31027c0f3d

                    SHA256

                    76d07b33364445e08dd5306a4e98d34edb6895a8269e9bb5aa9ef80e1cb83b2e

                    SHA512

                    b76759f28bcb68453dc32384f8bed1db071642f4ce5d9c84b14f2b172937b9a62f6e55857b74e14ca6e4c2a0f20bc6a50ab0e37fa36e59b364bdd2b108799c80

                  • C:\Users\Public\vbc.exe
                    MD5

                    db601737341d075854a7a92dcfe2c9f9

                    SHA1

                    16b3755c07814422eb01664b67370e31027c0f3d

                    SHA256

                    76d07b33364445e08dd5306a4e98d34edb6895a8269e9bb5aa9ef80e1cb83b2e

                    SHA512

                    b76759f28bcb68453dc32384f8bed1db071642f4ce5d9c84b14f2b172937b9a62f6e55857b74e14ca6e4c2a0f20bc6a50ab0e37fa36e59b364bdd2b108799c80

                  • \Users\Admin\AppData\Local\Temp\lzxupx.exe
                    MD5

                    12c84e3b91a0d7b34b8dec119629f515

                    SHA1

                    201d94893c58230d20cd33a18a1e44ee0c1cae60

                    SHA256

                    de9764977cb43f68e1ece123bea4c000963dd89d65f8c8bdfcc471809fe6828e

                    SHA512

                    0ce22f490865b1f733a79393eae96545b91892c21563d9657d01496579db61a9303fed92cbf5b4069f445525ab87b18870195d55d3bd680ec22c842daf989364

                  • \Users\Admin\AppData\Local\Temp\lzxupx.exe
                    MD5

                    12c84e3b91a0d7b34b8dec119629f515

                    SHA1

                    201d94893c58230d20cd33a18a1e44ee0c1cae60

                    SHA256

                    de9764977cb43f68e1ece123bea4c000963dd89d65f8c8bdfcc471809fe6828e

                    SHA512

                    0ce22f490865b1f733a79393eae96545b91892c21563d9657d01496579db61a9303fed92cbf5b4069f445525ab87b18870195d55d3bd680ec22c842daf989364

                  • \Users\Public\vbc.exe
                    MD5

                    db601737341d075854a7a92dcfe2c9f9

                    SHA1

                    16b3755c07814422eb01664b67370e31027c0f3d

                    SHA256

                    76d07b33364445e08dd5306a4e98d34edb6895a8269e9bb5aa9ef80e1cb83b2e

                    SHA512

                    b76759f28bcb68453dc32384f8bed1db071642f4ce5d9c84b14f2b172937b9a62f6e55857b74e14ca6e4c2a0f20bc6a50ab0e37fa36e59b364bdd2b108799c80

                  • \Users\Public\vbc.exe
                    MD5

                    db601737341d075854a7a92dcfe2c9f9

                    SHA1

                    16b3755c07814422eb01664b67370e31027c0f3d

                    SHA256

                    76d07b33364445e08dd5306a4e98d34edb6895a8269e9bb5aa9ef80e1cb83b2e

                    SHA512

                    b76759f28bcb68453dc32384f8bed1db071642f4ce5d9c84b14f2b172937b9a62f6e55857b74e14ca6e4c2a0f20bc6a50ab0e37fa36e59b364bdd2b108799c80

                  • \Users\Public\vbc.exe
                    MD5

                    db601737341d075854a7a92dcfe2c9f9

                    SHA1

                    16b3755c07814422eb01664b67370e31027c0f3d

                    SHA256

                    76d07b33364445e08dd5306a4e98d34edb6895a8269e9bb5aa9ef80e1cb83b2e

                    SHA512

                    b76759f28bcb68453dc32384f8bed1db071642f4ce5d9c84b14f2b172937b9a62f6e55857b74e14ca6e4c2a0f20bc6a50ab0e37fa36e59b364bdd2b108799c80

                  • memory/360-59-0x0000000075AC1000-0x0000000075AC3000-memory.dmp
                  • memory/636-77-0x000000000041D000-0x000000000041E000-memory.dmp
                  • memory/636-73-0x0000000000400000-0x0000000000429000-memory.dmp
                  • memory/636-78-0x00000000003A0000-0x00000000003B1000-memory.dmp
                  • memory/636-75-0x0000000000A00000-0x0000000000D03000-memory.dmp
                  • memory/1268-79-0x0000000006F10000-0x00000000070AF000-memory.dmp
                  • memory/1268-84-0x0000000007750000-0x0000000007872000-memory.dmp
                  • memory/1624-56-0x0000000070F21000-0x0000000070F23000-memory.dmp
                  • memory/1624-58-0x0000000071F0D000-0x0000000071F18000-memory.dmp
                  • memory/1624-55-0x000000002FE51000-0x000000002FE54000-memory.dmp
                  • memory/1624-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
                  • memory/1624-85-0x000000005FFF0000-0x0000000060000000-memory.dmp
                  • memory/1692-81-0x0000000000080000-0x00000000000A9000-memory.dmp
                  • memory/1692-80-0x00000000005D0000-0x00000000005DD000-memory.dmp
                  • memory/1692-82-0x0000000001FF0000-0x00000000022F3000-memory.dmp
                  • memory/1692-83-0x00000000004E0000-0x0000000000570000-memory.dmp