Analysis

  • max time kernel
    167s
  • max time network
    212s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 00:39

General

  • Target

    PO0932083943974.exe

  • Size

    351KB

  • MD5

    1e8d5e2871ef3da902db085c1b5c9e4f

  • SHA1

    a3e42499d53bcf961dfbaceca2c3fb5fc4d54364

  • SHA256

    dee1fa115a3e06310b958baca7bf709144f770de027ab3c615f6937b7544cd75

  • SHA512

    bbba879de92397a2141aaa4e780a99e1434e171d31dd2698e97363518b140635c20adb98718073f7d2b12935a14bde61b70ff7d5d528058c4a50794b865f2446

Malware Config

Extracted

Family

xloader

Version

2.0

Campaign

b6fg

Decoy

multlockmt5.com

mohajrannoor.com

robynhoodofretail.info

belinv.com

hotellasab.com

kibrismosad.com

xn--fxwm39aeb590h.xn--io0a7i

resetbrasil.com

tcsonhvac.com

theresav.net

bohoqi.info

machinafuturae.com

mambavault.com

xn--980am9a.top

yumiang.com

evntmonitor.com

83003kk.com

triterm.com

8800pe.com

silvanstudio.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 4 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Users\Admin\AppData\Local\Temp\PO0932083943974.exe
      "C:\Users\Admin\AppData\Local\Temp\PO0932083943974.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:956
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1476
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
          PID:300
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:1128

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scripting

      1
      T1064

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      2
      T1112

      Scripting

      1
      T1064

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/300-72-0x0000000000000000-mapping.dmp
      • memory/956-55-0x0000000000200000-0x000000000020A000-memory.dmp
        Filesize

        40KB

      • memory/956-56-0x00000000006B0000-0x00000000006E6000-memory.dmp
        Filesize

        216KB

      • memory/956-54-0x00000000012C0000-0x000000000131E000-memory.dmp
        Filesize

        376KB

      • memory/1384-65-0x00000000046D0000-0x00000000047B2000-memory.dmp
        Filesize

        904KB

      • memory/1384-77-0x0000000004BD0000-0x0000000004CB3000-memory.dmp
        Filesize

        908KB

      • memory/1384-68-0x0000000004AE0000-0x0000000004BC3000-memory.dmp
        Filesize

        908KB

      • memory/1476-66-0x0000000000400000-0x0000000000427000-memory.dmp
        Filesize

        156KB

      • memory/1476-58-0x0000000000400000-0x0000000000427000-memory.dmp
        Filesize

        156KB

      • memory/1476-63-0x0000000000A80000-0x0000000000D83000-memory.dmp
        Filesize

        3.0MB

      • memory/1476-61-0x000000000041C160-mapping.dmp
      • memory/1476-67-0x00000000003E0000-0x00000000003F0000-memory.dmp
        Filesize

        64KB

      • memory/1476-60-0x0000000000400000-0x0000000000427000-memory.dmp
        Filesize

        156KB

      • memory/1476-57-0x0000000000400000-0x0000000000427000-memory.dmp
        Filesize

        156KB

      • memory/1476-64-0x00000000001B0000-0x00000000001C0000-memory.dmp
        Filesize

        64KB

      • memory/2024-70-0x00000000753B1000-0x00000000753B3000-memory.dmp
        Filesize

        8KB

      • memory/2024-71-0x0000000074BE1000-0x0000000074BE3000-memory.dmp
        Filesize

        8KB

      • memory/2024-73-0x00000000008B0000-0x0000000000B31000-memory.dmp
        Filesize

        2.5MB

      • memory/2024-74-0x0000000000080000-0x00000000000A7000-memory.dmp
        Filesize

        156KB

      • memory/2024-75-0x00000000024A0000-0x00000000027A3000-memory.dmp
        Filesize

        3.0MB

      • memory/2024-76-0x0000000000430000-0x00000000004BF000-memory.dmp
        Filesize

        572KB

      • memory/2024-69-0x0000000000000000-mapping.dmp