Resubmissions

22-03-2022 08:31

220322-keqg6segf3 10

17-03-2022 12:00

220317-n6d51adcg8 10

Analysis

  • max time kernel
    600s
  • max time network
    601s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    22-03-2022 08:31

General

  • Target

    f5G3iGDs25iJjZE.exe

  • Size

    1.1MB

  • MD5

    33899614b3fe24bc02dfb4c1f84dabdc

  • SHA1

    8dbc988c06f51cce14e4cc95717241fb1521fac6

  • SHA256

    b36891ab4a7fa6be1680a65614dd5551a3fa8a89052c381a954601eedd82e62c

  • SHA512

    30058e2e8d6da6b5e0db01cdab70cfb9af8bfb93aed69a009cdba0f1be4c9b805472a531a5abd4dc56f46349ff43a6ce797e98123898719a38e5329920aac5ad

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

wdc8

Decoy

mygotomaid.com

joyoushealthandwellnessspa.com

wefundprojects.com

magicbasketbourse.net

vitos3.xyz

oligopoly.city

beauty-bihada.asia

visitnewrichmond.com

crgeniusworld.biz

bantasis.com

transsexual.pro

casagraph.com

eastjamrecords.com

howtotrainyourmustache.com

heiappropriate.xyz

bataperu.com

ces341.com

prajahitha.com

manuelagattegger.com

wolfpackmotorcycletours.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe
      "C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3732
      • C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe
        "C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe"
        3⤵
          PID:2376
        • C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe
          "C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1592
      • C:\Windows\SysWOW64\msdt.exe
        "C:\Windows\SysWOW64\msdt.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1940
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe"
          3⤵
            PID:2988
          • C:\Windows\SysWOW64\cmd.exe
            /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
            3⤵
              PID:4648
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:1152
            • C:\Program Files (x86)\Ihv1pdx\igfxvzf.exe
              "C:\Program Files (x86)\Ihv1pdx\igfxvzf.exe"
              2⤵
              • Executes dropped EXE
              PID:636
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 1176
                3⤵
                • Program crash
                PID:1536
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 636 -ip 636
            1⤵
              PID:1508

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Persistence

            Registry Run Keys / Startup Folder

            1
            T1060

            Defense Evasion

            Modify Registry

            2
            T1112

            Credential Access

            Credentials in Files

            1
            T1081

            Collection

            Data from Local System

            1
            T1005

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Ihv1pdx\igfxvzf.exe
              MD5

              0274a5571bbdc3173e0cd7358050f1a1

              SHA1

              d75f9ae18bb0bc3870f49ee14fdf0c909fcc0ca4

              SHA256

              781f165eb40ab8555b933b2487cf580ab627fdd00b766104ba5e53e69a9bdd5d

              SHA512

              941516c63f6eb8dca9e679bedefe078884b39b12608cdfa33444b1943a0c8805276cfde287d39443b3fd65ef86de6bea712b703c9937e8a5123f471d511f36f2

            • C:\Program Files (x86)\Ihv1pdx\igfxvzf.exe
              MD5

              0274a5571bbdc3173e0cd7358050f1a1

              SHA1

              d75f9ae18bb0bc3870f49ee14fdf0c909fcc0ca4

              SHA256

              781f165eb40ab8555b933b2487cf580ab627fdd00b766104ba5e53e69a9bdd5d

              SHA512

              941516c63f6eb8dca9e679bedefe078884b39b12608cdfa33444b1943a0c8805276cfde287d39443b3fd65ef86de6bea712b703c9937e8a5123f471d511f36f2

            • C:\Users\Admin\AppData\Local\Temp\DB1
              MD5

              b608d407fc15adea97c26936bc6f03f6

              SHA1

              953e7420801c76393902c0d6bb56148947e41571

              SHA256

              b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

              SHA512

              cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

            • memory/636-153-0x00000000031F0000-0x0000000003282000-memory.dmp
              Filesize

              584KB

            • memory/636-152-0x0000000072E70000-0x0000000073620000-memory.dmp
              Filesize

              7.7MB

            • memory/636-151-0x0000000000D40000-0x0000000000E5C000-memory.dmp
              Filesize

              1.1MB

            • memory/1592-141-0x0000000001200000-0x0000000001211000-memory.dmp
              Filesize

              68KB

            • memory/1592-137-0x0000000000400000-0x0000000000429000-memory.dmp
              Filesize

              164KB

            • memory/1592-139-0x0000000001250000-0x000000000159A000-memory.dmp
              Filesize

              3.3MB

            • memory/1592-140-0x000000000041D000-0x000000000041E000-memory.dmp
              Filesize

              4KB

            • memory/1940-146-0x0000000003000000-0x0000000003090000-memory.dmp
              Filesize

              576KB

            • memory/1940-144-0x0000000001070000-0x0000000001099000-memory.dmp
              Filesize

              164KB

            • memory/1940-143-0x0000000000970000-0x00000000009C7000-memory.dmp
              Filesize

              348KB

            • memory/1940-145-0x00000000031B0000-0x00000000034FA000-memory.dmp
              Filesize

              3.3MB

            • memory/2060-142-0x0000000007E40000-0x0000000007F73000-memory.dmp
              Filesize

              1.2MB

            • memory/2060-147-0x0000000007F80000-0x00000000080D9000-memory.dmp
              Filesize

              1.3MB

            • memory/3732-130-0x0000000000630000-0x000000000074C000-memory.dmp
              Filesize

              1.1MB

            • memory/3732-136-0x0000000008E40000-0x0000000008EDC000-memory.dmp
              Filesize

              624KB

            • memory/3732-135-0x00000000051B0000-0x00000000051BA000-memory.dmp
              Filesize

              40KB

            • memory/3732-134-0x0000000005060000-0x00000000050F2000-memory.dmp
              Filesize

              584KB

            • memory/3732-133-0x0000000074E20000-0x00000000755D0000-memory.dmp
              Filesize

              7.7MB

            • memory/3732-132-0x0000000005100000-0x0000000005192000-memory.dmp
              Filesize

              584KB

            • memory/3732-131-0x00000000057B0000-0x0000000005D54000-memory.dmp
              Filesize

              5.6MB