Analysis
- max time kernel
147s - max time network
150s - platform
windows7_x64 - resource
win7-20220414-en - submitted
19/05/2022, 14:37
General
- Target 27fe38ce70fca4c4526c07a42449f11e.exe
- Size 260KB
- Sample220519-ry481abdeq
- SHA256 fe55fb664c32bacbd76bf8859a8a2cd17f23d21f08a22ac9881cb0fa33935990
Malware Config
Extracted
-
xloader
-
2.6
-
be4o
-
laboratoriobioixcha.com
-
tictocperushop.online
-
wild-oceans.com
-
belaruscountry.com
-
kicktmall.com
-
fitcoinweb.tech
-
mores.one
-
gogear.one
-
gxrcksy.com
-
samrcq.com
-
impossible-icecream.com
-
bravesxx.com
-
bookchainart.com
-
sleepsolutionsofmboro.com
-
ocbrazilbusinessclub.com
-
advisor76.xyz
-
xitaotech.com
-
mgsdtytifgf3414.xyz
-
johnson-brown.net
-
cr3drt.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Executes dropped EXE 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Program Files directory 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\27fe38ce70fca4c4526c07a42449f11e.exe"C:\Users\Admin\AppData\Local\Temp\27fe38ce70fca4c4526c07a42449f11e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
-
C:\Program Files (x86)\Eadil_rg\mfcadfh1.exe"C:\Program Files (x86)\Eadil_rg\mfcadfh1.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
mfcadfh1.exe
mfcadfh1.exe
memory/776-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp
memory/776-54-0x00000000001A0000-0x00000000001E6000-memory.dmp
memory/1224-65-0x0000000004AA0000-0x0000000004BD6000-memory.dmp
memory/1224-73-0x0000000004D60000-0x0000000004E6B000-memory.dmp
memory/1808-64-0x00000000001F0000-0x0000000000201000-memory.dmp
memory/1808-63-0x0000000000D90000-0x0000000001093000-memory.dmp
memory/1808-61-0x0000000000080000-0x00000000000AB000-memory.dmp
memory/1808-57-0x0000000000080000-0x00000000000AB000-memory.dmp
memory/1808-56-0x0000000000080000-0x00000000000AB000-memory.dmp
memory/2016-69-0x0000000000F90000-0x0000000000FAF000-memory.dmp
memory/2016-70-0x0000000000080000-0x00000000000AB000-memory.dmp
memory/2016-71-0x0000000000BE0000-0x0000000000EE3000-memory.dmp
memory/2016-72-0x0000000000EF0000-0x0000000000F80000-memory.dmp