Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 05:23

General

  • Target

    44a6829e3ee6c5d98fccde99b502f7e2.exe

  • Size

    260KB

  • MD5

    44a6829e3ee6c5d98fccde99b502f7e2

  • SHA1

    a64dce6694fc716860a52b367317efc095e46756

  • SHA256

    6b80459293e1eae78fa4efafbc8ddae1fb2bdb73c35c0b1880fdb65d80a49114

  • SHA512

    94a51cc57016387bc64107f4b159dd9bfb588fca597bbec9137e94ef832e2a1471a742bd20de3405f2c9cdf4b3b7436ac6889295ba424d678236232d148c26cd

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

be4o

Decoy

laboratoriobioixcha.com

tictocperushop.online

wild-oceans.com

belaruscountry.com

kicktmall.com

fitcoinweb.tech

mores.one

gogear.one

gxrcksy.com

samrcq.com

impossible-icecream.com

bravesxx.com

bookchainart.com

sleepsolutionsofmboro.com

ocbrazilbusinessclub.com

advisor76.xyz

xitaotech.com

mgsdtytifgf3414.xyz

johnson-brown.net

cr3drt.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Users\Admin\AppData\Local\Temp\44a6829e3ee6c5d98fccde99b502f7e2.exe
      "C:\Users\Admin\AppData\Local\Temp\44a6829e3ee6c5d98fccde99b502f7e2.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:560
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2020
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:1736
      • C:\Windows\SysWOW64\autochk.exe
        "C:\Windows\SysWOW64\autochk.exe"
        2⤵
          PID:1052
        • C:\Windows\SysWOW64\autochk.exe
          "C:\Windows\SysWOW64\autochk.exe"
          2⤵
            PID:1960
          • C:\Windows\SysWOW64\autochk.exe
            "C:\Windows\SysWOW64\autochk.exe"
            2⤵
              PID:1992
            • C:\Windows\SysWOW64\autochk.exe
              "C:\Windows\SysWOW64\autochk.exe"
              2⤵
                PID:1996
              • C:\Windows\SysWOW64\autochk.exe
                "C:\Windows\SysWOW64\autochk.exe"
                2⤵
                  PID:1940
                • C:\Windows\SysWOW64\autochk.exe
                  "C:\Windows\SysWOW64\autochk.exe"
                  2⤵
                    PID:1732
                  • C:\Windows\SysWOW64\autochk.exe
                    "C:\Windows\SysWOW64\autochk.exe"
                    2⤵
                      PID:1964
                    • C:\Windows\SysWOW64\autochk.exe
                      "C:\Windows\SysWOW64\autochk.exe"
                      2⤵
                        PID:1952
                      • C:\Windows\SysWOW64\autochk.exe
                        "C:\Windows\SysWOW64\autochk.exe"
                        2⤵
                          PID:600
                        • C:\Windows\SysWOW64\autochk.exe
                          "C:\Windows\SysWOW64\autochk.exe"
                          2⤵
                            PID:288
                          • C:\Windows\SysWOW64\autochk.exe
                            "C:\Windows\SysWOW64\autochk.exe"
                            2⤵
                              PID:324
                            • C:\Windows\SysWOW64\autochk.exe
                              "C:\Windows\SysWOW64\autochk.exe"
                              2⤵
                                PID:1148
                              • C:\Windows\SysWOW64\autochk.exe
                                "C:\Windows\SysWOW64\autochk.exe"
                                2⤵
                                  PID:1724
                                • C:\Windows\SysWOW64\wuapp.exe
                                  "C:\Windows\SysWOW64\wuapp.exe"
                                  2⤵
                                  • Adds Run key to start application
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Program Files directory
                                  • Modifies Internet Explorer settings
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:1336
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                    3⤵
                                      PID:824
                                    • C:\Program Files\Mozilla Firefox\Firefox.exe
                                      "C:\Program Files\Mozilla Firefox\Firefox.exe"
                                      3⤵
                                        PID:764

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v6

                                  Execution

                                  Scripting

                                  1
                                  T1064

                                  Persistence

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1060

                                  Defense Evasion

                                  Scripting

                                  1
                                  T1064

                                  Modify Registry

                                  2
                                  T1112

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • memory/560-54-0x0000000001150000-0x0000000001196000-memory.dmp
                                    Filesize

                                    280KB

                                  • memory/560-55-0x0000000075271000-0x0000000075273000-memory.dmp
                                    Filesize

                                    8KB

                                  • memory/824-70-0x0000000000000000-mapping.dmp
                                  • memory/1336-75-0x0000000000630000-0x00000000006C0000-memory.dmp
                                    Filesize

                                    576KB

                                  • memory/1336-73-0x0000000002160000-0x0000000002463000-memory.dmp
                                    Filesize

                                    3.0MB

                                  • memory/1336-72-0x00000000000D0000-0x00000000000FB000-memory.dmp
                                    Filesize

                                    172KB

                                  • memory/1336-71-0x00000000001B0000-0x00000000001BB000-memory.dmp
                                    Filesize

                                    44KB

                                  • memory/1336-69-0x0000000000000000-mapping.dmp
                                  • memory/1428-65-0x00000000067A0000-0x00000000068A0000-memory.dmp
                                    Filesize

                                    1024KB

                                  • memory/1428-68-0x00000000069A0000-0x0000000006A84000-memory.dmp
                                    Filesize

                                    912KB

                                  • memory/1428-76-0x0000000007100000-0x0000000007253000-memory.dmp
                                    Filesize

                                    1.3MB

                                  • memory/2020-66-0x0000000000080000-0x00000000000AB000-memory.dmp
                                    Filesize

                                    172KB

                                  • memory/2020-67-0x0000000000250000-0x0000000000261000-memory.dmp
                                    Filesize

                                    68KB

                                  • memory/2020-64-0x0000000000170000-0x0000000000181000-memory.dmp
                                    Filesize

                                    68KB

                                  • memory/2020-63-0x0000000000EF0000-0x00000000011F3000-memory.dmp
                                    Filesize

                                    3.0MB

                                  • memory/2020-61-0x0000000000080000-0x00000000000AB000-memory.dmp
                                    Filesize

                                    172KB

                                  • memory/2020-60-0x000000000041F270-mapping.dmp
                                  • memory/2020-57-0x0000000000080000-0x00000000000AB000-memory.dmp
                                    Filesize

                                    172KB

                                  • memory/2020-56-0x0000000000080000-0x00000000000AB000-memory.dmp
                                    Filesize

                                    172KB