Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    22-02-2022 09:23

General

  • Target

    MV LILY SEA_xlsx.exe

  • Size

    294KB

  • MD5

    6ec38c4638933adf4e6431c599572869

  • SHA1

    7daceef37fd49f19393b9cc0c03b5bd0625b6eb4

  • SHA256

    4693178ae42f25930859574bbaa0b9eb93a011b9233c43639c53689ecd47a15c

  • SHA512

    08836096c927d30c9dc4207bbdb0468234f4c2e44eeb873ba755d8976ea578d041c708d97a97cff85cbf8ac27841cba9c1683b54b67e2da029ade8cb8e5d3257

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dtt3

Decoy

edilononlineshop.com

cursosd.com

viellacharteredland.com

increasey0urenergylevels.codes

yjy-hotel.com

claym.xyz

reelsguide.com

gives-cardano.com

ashrafannuar.com

mammalians.com

rocketleaguedads.com

yubierp.com

minimi36.com

chn-chn.com

jagojp888.com

parsian-shetab.com

273351.com

mdtouhid.com

babedads.com

vallinam2.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\MV LILY SEA_xlsx.exe
      "C:\Users\Admin\AppData\Local\Temp\MV LILY SEA_xlsx.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\AppData\Local\Temp\dtppertj.exe
        C:\Users\Admin\AppData\Local\Temp\dtppertj.exe C:\Users\Admin\AppData\Local\Temp\gjajpuko
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:804
        • C:\Users\Admin\AppData\Local\Temp\dtppertj.exe
          C:\Users\Admin\AppData\Local\Temp\dtppertj.exe C:\Users\Admin\AppData\Local\Temp\gjajpuko
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1636
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1496
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\dtppertj.exe"
        3⤵
          PID:1500
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:1964
        • C:\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe
          "C:\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1244
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 188
            3⤵
            • Loads dropped DLL
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:852

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      2
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe
        MD5

        5d708187202ff76979fa629b1699ea90

        SHA1

        115946ec185770a7ef6f2fd5c166a226ba43e938

        SHA256

        0055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27

        SHA512

        5a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b

      • C:\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe
        MD5

        5d708187202ff76979fa629b1699ea90

        SHA1

        115946ec185770a7ef6f2fd5c166a226ba43e938

        SHA256

        0055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27

        SHA512

        5a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b

      • C:\Users\Admin\AppData\Local\Temp\dtppertj.exe
        MD5

        5d708187202ff76979fa629b1699ea90

        SHA1

        115946ec185770a7ef6f2fd5c166a226ba43e938

        SHA256

        0055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27

        SHA512

        5a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b

      • C:\Users\Admin\AppData\Local\Temp\dtppertj.exe
        MD5

        5d708187202ff76979fa629b1699ea90

        SHA1

        115946ec185770a7ef6f2fd5c166a226ba43e938

        SHA256

        0055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27

        SHA512

        5a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b

      • C:\Users\Admin\AppData\Local\Temp\dtppertj.exe
        MD5

        5d708187202ff76979fa629b1699ea90

        SHA1

        115946ec185770a7ef6f2fd5c166a226ba43e938

        SHA256

        0055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27

        SHA512

        5a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b

      • C:\Users\Admin\AppData\Local\Temp\gjajpuko
        MD5

        ae3d43c640983d2fc0eb4146c712832d

        SHA1

        5ea8807d63c462a9aaa56d75e83a92415424789c

        SHA256

        f95f89002e8a5c0a365c34e8bc5d44999cf395b8a5a148c28a4a3ddea147d77a

        SHA512

        668501d2ee8382fee0039c6056d251bfd3a7ec23b8689a8dd98ea7a21cfec354e0131ddc9a8ca1b70819672c50e24d721dcebee0437064b42d58a9c55d9a81bb

      • C:\Users\Admin\AppData\Local\Temp\jx3ysnwt15tyrf7a
        MD5

        7ab27baca052a3c9073b91a47837b5f4

        SHA1

        9a65e1d87ae66b250bb7a996a1e2417c766cb5e0

        SHA256

        bebdbe0b879c05c334e50f0450a2b4442194871fe4472e618fd9b6d8937107d2

        SHA512

        06b30e6fb1fa9c91c6631405d7c33ac4a94e3dbedde78d630ebe1a516847c187655abdd9a9b9d036d9358f94a8c6ac3831761d099f106213f154be1fbeada889

      • \Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe
        MD5

        5d708187202ff76979fa629b1699ea90

        SHA1

        115946ec185770a7ef6f2fd5c166a226ba43e938

        SHA256

        0055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27

        SHA512

        5a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b

      • \Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe
        MD5

        5d708187202ff76979fa629b1699ea90

        SHA1

        115946ec185770a7ef6f2fd5c166a226ba43e938

        SHA256

        0055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27

        SHA512

        5a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b

      • \Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe
        MD5

        5d708187202ff76979fa629b1699ea90

        SHA1

        115946ec185770a7ef6f2fd5c166a226ba43e938

        SHA256

        0055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27

        SHA512

        5a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b

      • \Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe
        MD5

        5d708187202ff76979fa629b1699ea90

        SHA1

        115946ec185770a7ef6f2fd5c166a226ba43e938

        SHA256

        0055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27

        SHA512

        5a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b

      • \Users\Admin\AppData\Local\Temp\dtppertj.exe
        MD5

        5d708187202ff76979fa629b1699ea90

        SHA1

        115946ec185770a7ef6f2fd5c166a226ba43e938

        SHA256

        0055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27

        SHA512

        5a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b

      • \Users\Admin\AppData\Local\Temp\dtppertj.exe
        MD5

        5d708187202ff76979fa629b1699ea90

        SHA1

        115946ec185770a7ef6f2fd5c166a226ba43e938

        SHA256

        0055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27

        SHA512

        5a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b

      • memory/852-84-0x0000000000240000-0x0000000000241000-memory.dmp
        Filesize

        4KB

      • memory/1248-73-0x0000000009230000-0x00000000093AF000-memory.dmp
        Filesize

        1.5MB

      • memory/1248-68-0x00000000073D0000-0x00000000074BC000-memory.dmp
        Filesize

        944KB

      • memory/1496-71-0x0000000001F50000-0x0000000002253000-memory.dmp
        Filesize

        3.0MB

      • memory/1496-72-0x0000000001D50000-0x0000000001DE0000-memory.dmp
        Filesize

        576KB

      • memory/1496-70-0x00000000000D0000-0x00000000000F9000-memory.dmp
        Filesize

        164KB

      • memory/1496-69-0x0000000000550000-0x0000000000555000-memory.dmp
        Filesize

        20KB

      • memory/1636-67-0x0000000000140000-0x0000000000151000-memory.dmp
        Filesize

        68KB

      • memory/1636-66-0x000000000041D000-0x000000000041E000-memory.dmp
        Filesize

        4KB

      • memory/1636-65-0x0000000000930000-0x0000000000C33000-memory.dmp
        Filesize

        3.0MB

      • memory/1636-62-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

      • memory/1672-54-0x0000000075341000-0x0000000075343000-memory.dmp
        Filesize

        8KB