Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21/06/2022, 08:21

General

  • Target

    Fawaz 2100355_1.xlsx

  • Size

    79KB

  • MD5

    d3f60231b4a3c60f3546c22dd22bd826

  • SHA1

    9965530e0e3299d0ed53a6cc7849e256069fc4b6

  • SHA256

    344c94ef6c05cefb4f3f36497f4f9ccc039ef43afbd39d1b6f239169c53d8df4

  • SHA512

    17a5697a44e7217407f297bd121ff75c9306decbf6d5b32fc565d838e716aed29c120fe78bcc2b2938ed1bb4c0eaa19f928fcb15a816b23f980a3c40e97a7a96

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

zgtb

Decoy

gabriellep.com

honghe4.xyz

anisaofrendas.com

happy-tile.com

thesulkies.com

international-ipo.com

tazeco.info

hhhzzz.xyz

vrmonster.xyz

theearthresidencia.com

sportape.xyz

elshadaibaterias.com

koredeiihibi.com

taxtaa.com

globalcityb.com

fxivcama.com

dagsmith.com

elmar-bhp.com

peakice.net

jhcdjewelry.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Xloader Payload 5 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Fawaz 2100355_1.xlsx"
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1100
    • C:\Windows\SysWOW64\NAPSTAT.EXE
      "C:\Windows\SysWOW64\NAPSTAT.EXE"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
        3⤵
          PID:856
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:1776
      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        PID:1180
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1820
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
            3⤵
              PID:1488
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
              3⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:792

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Public\vbc.exe

                Filesize

                370KB

                MD5

                d2d37362b56af2703f2c3dcfb36b56b4

                SHA1

                06c6acc7060fb356d5bc7693f8d4bcecbbb4fb62

                SHA256

                04e6039e29e0b8f6fb1ec1502a3225c74c4c18f6c0ba1ce10eb2c834ede7f149

                SHA512

                c6dc602d4785b3e0cab4d1cfd033c13dd29b8fe0e22439f11c74381af4350eea7f7ce392c3461878f855b4e267e8c104c0a6547ff9d946c50d80731212691307

              • C:\Users\Public\vbc.exe

                Filesize

                370KB

                MD5

                d2d37362b56af2703f2c3dcfb36b56b4

                SHA1

                06c6acc7060fb356d5bc7693f8d4bcecbbb4fb62

                SHA256

                04e6039e29e0b8f6fb1ec1502a3225c74c4c18f6c0ba1ce10eb2c834ede7f149

                SHA512

                c6dc602d4785b3e0cab4d1cfd033c13dd29b8fe0e22439f11c74381af4350eea7f7ce392c3461878f855b4e267e8c104c0a6547ff9d946c50d80731212691307

              • \Users\Public\vbc.exe

                Filesize

                370KB

                MD5

                d2d37362b56af2703f2c3dcfb36b56b4

                SHA1

                06c6acc7060fb356d5bc7693f8d4bcecbbb4fb62

                SHA256

                04e6039e29e0b8f6fb1ec1502a3225c74c4c18f6c0ba1ce10eb2c834ede7f149

                SHA512

                c6dc602d4785b3e0cab4d1cfd033c13dd29b8fe0e22439f11c74381af4350eea7f7ce392c3461878f855b4e267e8c104c0a6547ff9d946c50d80731212691307

              • \Users\Public\vbc.exe

                Filesize

                370KB

                MD5

                d2d37362b56af2703f2c3dcfb36b56b4

                SHA1

                06c6acc7060fb356d5bc7693f8d4bcecbbb4fb62

                SHA256

                04e6039e29e0b8f6fb1ec1502a3225c74c4c18f6c0ba1ce10eb2c834ede7f149

                SHA512

                c6dc602d4785b3e0cab4d1cfd033c13dd29b8fe0e22439f11c74381af4350eea7f7ce392c3461878f855b4e267e8c104c0a6547ff9d946c50d80731212691307

              • \Users\Public\vbc.exe

                Filesize

                370KB

                MD5

                d2d37362b56af2703f2c3dcfb36b56b4

                SHA1

                06c6acc7060fb356d5bc7693f8d4bcecbbb4fb62

                SHA256

                04e6039e29e0b8f6fb1ec1502a3225c74c4c18f6c0ba1ce10eb2c834ede7f149

                SHA512

                c6dc602d4785b3e0cab4d1cfd033c13dd29b8fe0e22439f11c74381af4350eea7f7ce392c3461878f855b4e267e8c104c0a6547ff9d946c50d80731212691307

              • \Users\Public\vbc.exe

                Filesize

                370KB

                MD5

                d2d37362b56af2703f2c3dcfb36b56b4

                SHA1

                06c6acc7060fb356d5bc7693f8d4bcecbbb4fb62

                SHA256

                04e6039e29e0b8f6fb1ec1502a3225c74c4c18f6c0ba1ce10eb2c834ede7f149

                SHA512

                c6dc602d4785b3e0cab4d1cfd033c13dd29b8fe0e22439f11c74381af4350eea7f7ce392c3461878f855b4e267e8c104c0a6547ff9d946c50d80731212691307

              • memory/792-71-0x0000000000400000-0x000000000042B000-memory.dmp

                Filesize

                172KB

              • memory/792-70-0x0000000000400000-0x000000000042B000-memory.dmp

                Filesize

                172KB

              • memory/792-77-0x0000000000140000-0x0000000000151000-memory.dmp

                Filesize

                68KB

              • memory/792-76-0x0000000000950000-0x0000000000C53000-memory.dmp

                Filesize

                3.0MB

              • memory/792-73-0x0000000000400000-0x000000000042B000-memory.dmp

                Filesize

                172KB

              • memory/792-80-0x0000000000400000-0x000000000042B000-memory.dmp

                Filesize

                172KB

              • memory/1100-58-0x0000000074B51000-0x0000000074B53000-memory.dmp

                Filesize

                8KB

              • memory/1100-69-0x0000000071E5D000-0x0000000071E68000-memory.dmp

                Filesize

                44KB

              • memory/1100-54-0x000000002F4D1000-0x000000002F4D4000-memory.dmp

                Filesize

                12KB

              • memory/1100-89-0x000000005FFF0000-0x0000000060000000-memory.dmp

                Filesize

                64KB

              • memory/1100-55-0x0000000070E71000-0x0000000070E73000-memory.dmp

                Filesize

                8KB

              • memory/1100-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

                Filesize

                64KB

              • memory/1100-90-0x0000000071E5D000-0x0000000071E68000-memory.dmp

                Filesize

                44KB

              • memory/1100-57-0x0000000071E5D000-0x0000000071E68000-memory.dmp

                Filesize

                44KB

              • memory/1364-82-0x0000000000D10000-0x0000000000D56000-memory.dmp

                Filesize

                280KB

              • memory/1364-84-0x00000000009F0000-0x0000000000CF3000-memory.dmp

                Filesize

                3.0MB

              • memory/1364-83-0x0000000000080000-0x00000000000AB000-memory.dmp

                Filesize

                172KB

              • memory/1364-85-0x00000000008C0000-0x0000000000950000-memory.dmp

                Filesize

                576KB

              • memory/1364-86-0x0000000000080000-0x00000000000AB000-memory.dmp

                Filesize

                172KB

              • memory/1400-78-0x0000000007360000-0x00000000074B7000-memory.dmp

                Filesize

                1.3MB

              • memory/1400-87-0x0000000009020000-0x000000000915E000-memory.dmp

                Filesize

                1.2MB

              • memory/1400-88-0x0000000009020000-0x000000000915E000-memory.dmp

                Filesize

                1.2MB

              • memory/1820-68-0x00000000005C0000-0x00000000005F4000-memory.dmp

                Filesize

                208KB

              • memory/1820-67-0x0000000000E90000-0x0000000000EF2000-memory.dmp

                Filesize

                392KB