Resubmissions

16-02-2022 14:43

220216-r31flsdagq 10

16-02-2022 14:37

220216-rzmeksdagk 10

16-02-2022 14:22

220216-rpkg8sdafl 10

Analysis

  • max time kernel
    1800s
  • max time network
    1804s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    16-02-2022 14:37

General

  • Target

    DELIVERY DOCUMENTS.exe

  • Size

    707KB

  • MD5

    427ef5f4e1143ad34c33b26dc4681661

  • SHA1

    673fb1a58e4707ad783d03ca97b3fbd8b4cad73a

  • SHA256

    cd4ee025ad3406b7e572952d42465eee19649cef6c0d3a6acbb0e972096988f4

  • SHA512

    b225afbb07853516f1b741e833e1a63026c0dc5adbb0c3fcfb48f8c6681bc770558499df3d3f5c17df45395dedc3624a1e8fa6498395ac20a82f44e27a61dfbb

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

zqzw

Decoy

laurentmathieu.com

nohohonndana.com

hhmc.info

shophallows.com

blazebunk.com

goodbridge.xyz

flakycloud.com

bakermckenziegroups.com

formation-adistance.com

lovingearthbotanicals.com

tbrservice.plus

heritagehousehotels.com

drwbuildersco.com

lacsghb.com

wain3x.com

dadreview.club

continiutycp.com

cockgirls.com

48mpt.xyz

033skz.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe
      "C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:748
      • C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:288
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:568
      • C:\Windows\SysWOW64\autochk.exe
        "C:\Windows\SysWOW64\autochk.exe"
        2⤵
          PID:1668
        • C:\Windows\SysWOW64\autochk.exe
          "C:\Windows\SysWOW64\autochk.exe"
          2⤵
            PID:572
          • C:\Windows\SysWOW64\autochk.exe
            "C:\Windows\SysWOW64\autochk.exe"
            2⤵
              PID:1844
            • C:\Windows\SysWOW64\autochk.exe
              "C:\Windows\SysWOW64\autochk.exe"
              2⤵
                PID:1400
              • C:\Windows\SysWOW64\autochk.exe
                "C:\Windows\SysWOW64\autochk.exe"
                2⤵
                  PID:1120
                • C:\Windows\SysWOW64\autochk.exe
                  "C:\Windows\SysWOW64\autochk.exe"
                  2⤵
                    PID:1700
                  • C:\Windows\SysWOW64\autochk.exe
                    "C:\Windows\SysWOW64\autochk.exe"
                    2⤵
                      PID:1524
                    • C:\Windows\SysWOW64\autochk.exe
                      "C:\Windows\SysWOW64\autochk.exe"
                      2⤵
                        PID:1156
                      • C:\Windows\SysWOW64\autochk.exe
                        "C:\Windows\SysWOW64\autochk.exe"
                        2⤵
                          PID:1716
                        • C:\Windows\SysWOW64\autochk.exe
                          "C:\Windows\SysWOW64\autochk.exe"
                          2⤵
                            PID:1940
                          • C:\Windows\SysWOW64\raserver.exe
                            "C:\Windows\SysWOW64\raserver.exe"
                            2⤵
                            • Adds Run key to start application
                            • Suspicious use of SetThreadContext
                            • Drops file in Program Files directory
                            • Modifies Internet Explorer settings
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:436
                            • C:\Windows\SysWOW64\cmd.exe
                              /c del "C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe"
                              3⤵
                              • Deletes itself
                              PID:1060
                            • C:\Program Files\Mozilla Firefox\Firefox.exe
                              "C:\Program Files\Mozilla Firefox\Firefox.exe"
                              3⤵
                                PID:1128
                            • C:\Program Files (x86)\Knlrdi\igfxgnu.exe
                              "C:\Program Files (x86)\Knlrdi\igfxgnu.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious use of WriteProcessMemory
                              PID:1592
                              • C:\Program Files (x86)\Knlrdi\igfxgnu.exe
                                "{path}"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:872

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Persistence

                          Registry Run Keys / Startup Folder

                          1
                          T1060

                          Defense Evasion

                          Modify Registry

                          2
                          T1112

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Program Files (x86)\Knlrdi\igfxgnu.exe
                            MD5

                            427ef5f4e1143ad34c33b26dc4681661

                            SHA1

                            673fb1a58e4707ad783d03ca97b3fbd8b4cad73a

                            SHA256

                            cd4ee025ad3406b7e572952d42465eee19649cef6c0d3a6acbb0e972096988f4

                            SHA512

                            b225afbb07853516f1b741e833e1a63026c0dc5adbb0c3fcfb48f8c6681bc770558499df3d3f5c17df45395dedc3624a1e8fa6498395ac20a82f44e27a61dfbb

                          • C:\Program Files (x86)\Knlrdi\igfxgnu.exe
                            MD5

                            427ef5f4e1143ad34c33b26dc4681661

                            SHA1

                            673fb1a58e4707ad783d03ca97b3fbd8b4cad73a

                            SHA256

                            cd4ee025ad3406b7e572952d42465eee19649cef6c0d3a6acbb0e972096988f4

                            SHA512

                            b225afbb07853516f1b741e833e1a63026c0dc5adbb0c3fcfb48f8c6681bc770558499df3d3f5c17df45395dedc3624a1e8fa6498395ac20a82f44e27a61dfbb

                          • C:\Program Files (x86)\Knlrdi\igfxgnu.exe
                            MD5

                            427ef5f4e1143ad34c33b26dc4681661

                            SHA1

                            673fb1a58e4707ad783d03ca97b3fbd8b4cad73a

                            SHA256

                            cd4ee025ad3406b7e572952d42465eee19649cef6c0d3a6acbb0e972096988f4

                            SHA512

                            b225afbb07853516f1b741e833e1a63026c0dc5adbb0c3fcfb48f8c6681bc770558499df3d3f5c17df45395dedc3624a1e8fa6498395ac20a82f44e27a61dfbb

                          • memory/288-65-0x000000000041D000-0x000000000041E000-memory.dmp
                            Filesize

                            4KB

                          • memory/288-66-0x00000000001D0000-0x00000000001E1000-memory.dmp
                            Filesize

                            68KB

                          • memory/288-64-0x0000000000A80000-0x0000000000D83000-memory.dmp
                            Filesize

                            3.0MB

                          • memory/288-60-0x0000000000400000-0x0000000000429000-memory.dmp
                            Filesize

                            164KB

                          • memory/288-61-0x0000000000400000-0x0000000000429000-memory.dmp
                            Filesize

                            164KB

                          • memory/288-62-0x0000000000400000-0x0000000000429000-memory.dmp
                            Filesize

                            164KB

                          • memory/436-70-0x00000000000C0000-0x00000000000E9000-memory.dmp
                            Filesize

                            164KB

                          • memory/436-68-0x0000000074F01000-0x0000000074F03000-memory.dmp
                            Filesize

                            8KB

                          • memory/436-69-0x0000000000310000-0x000000000032C000-memory.dmp
                            Filesize

                            112KB

                          • memory/436-71-0x0000000001F80000-0x0000000002283000-memory.dmp
                            Filesize

                            3.0MB

                          • memory/436-72-0x0000000001DF0000-0x0000000001E80000-memory.dmp
                            Filesize

                            576KB

                          • memory/748-59-0x0000000000650000-0x0000000000680000-memory.dmp
                            Filesize

                            192KB

                          • memory/748-58-0x0000000004ED0000-0x0000000004F52000-memory.dmp
                            Filesize

                            520KB

                          • memory/748-54-0x0000000000280000-0x0000000000338000-memory.dmp
                            Filesize

                            736KB

                          • memory/748-57-0x0000000004E90000-0x0000000004E91000-memory.dmp
                            Filesize

                            4KB

                          • memory/748-56-0x0000000000370000-0x000000000037A000-memory.dmp
                            Filesize

                            40KB

                          • memory/748-55-0x0000000073AEE000-0x0000000073AEF000-memory.dmp
                            Filesize

                            4KB

                          • memory/872-83-0x0000000000910000-0x0000000000C13000-memory.dmp
                            Filesize

                            3.0MB

                          • memory/1412-67-0x0000000006D00000-0x0000000006E27000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/1412-73-0x00000000049C0000-0x0000000004A53000-memory.dmp
                            Filesize

                            588KB

                          • memory/1592-77-0x000000007407E000-0x000000007407F000-memory.dmp
                            Filesize

                            4KB

                          • memory/1592-78-0x00000000048A0000-0x00000000048A1000-memory.dmp
                            Filesize

                            4KB

                          • memory/1592-76-0x0000000000D50000-0x0000000000E08000-memory.dmp
                            Filesize

                            736KB