Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    21/06/2022, 08:31

General

  • Target

    9454ba36d9a763b8543f599961cafb7a33397340ccb59b17921748771d49cd43.exe

  • Size

    99KB

  • MD5

    fc2ab61fce7f203add8bd65a77df7de5

  • SHA1

    423261d0362864ecc99f05a726a940b33b69f5df

  • SHA256

    9454ba36d9a763b8543f599961cafb7a33397340ccb59b17921748771d49cd43

  • SHA512

    5c91637dd9083b7a1c98ccf0ad852582710ffe2d733e285e733439a1a0cae3535a1b2473f7d8e6a83ebc0545a106d806c896ae84d62bbe76077dfaeac8686e79

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

uu0p

Decoy

easeupp.com

ffffcc.xyz

commercialsymposium.com

bahamascargologistics.com

avajwelr.xyz

flipwatch.xyz

serprobumar.com

zlasher.store

zxlsn6.com

xiaojiaowanwan.com

hrkpacking.com

visitprnow.com

stkjzz.com

printfusion.net

blackoakssavannah.com

yuiseika.com

watnefarms.com

oneclickmsp.com

niu-tou.com

wholytraffic.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

  • Xloader Payload 5 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\9454ba36d9a763b8543f599961cafb7a33397340ccb59b17921748771d49cd43.exe
      "C:\Users\Admin\AppData\Local\Temp\9454ba36d9a763b8543f599961cafb7a33397340ccb59b17921748771d49cd43.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout 20
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Windows\SysWOW64\timeout.exe
          timeout 20
          4⤵
          • Delays execution with timeout.exe
          PID:3816
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:208
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3300
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        3⤵
          PID:2700
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:1924
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            3⤵
              PID:3360

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\DB1

                Filesize

                40KB

                MD5

                b608d407fc15adea97c26936bc6f03f6

                SHA1

                953e7420801c76393902c0d6bb56148947e41571

                SHA256

                b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                SHA512

                cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

              • memory/208-247-0x0000000000400000-0x000000000042B000-memory.dmp

                Filesize

                172KB

              • memory/208-264-0x0000000001000000-0x0000000001320000-memory.dmp

                Filesize

                3.1MB

              • memory/208-265-0x0000000000A50000-0x0000000000B9A000-memory.dmp

                Filesize

                1.3MB

              • memory/208-269-0x0000000000400000-0x000000000042B000-memory.dmp

                Filesize

                172KB

              • memory/3028-324-0x00000000055B0000-0x00000000056AD000-memory.dmp

                Filesize

                1012KB

              • memory/3028-325-0x00000000055B0000-0x00000000056AD000-memory.dmp

                Filesize

                1012KB

              • memory/3028-266-0x0000000002F30000-0x000000000300F000-memory.dmp

                Filesize

                892KB

              • memory/3300-322-0x0000000003200000-0x000000000322B000-memory.dmp

                Filesize

                172KB

              • memory/3300-320-0x00000000047B0000-0x0000000004AD0000-memory.dmp

                Filesize

                3.1MB

              • memory/3300-323-0x0000000004B60000-0x0000000004BF0000-memory.dmp

                Filesize

                576KB

              • memory/3300-313-0x0000000003200000-0x000000000322B000-memory.dmp

                Filesize

                172KB

              • memory/3300-312-0x0000000000BD0000-0x0000000000D43000-memory.dmp

                Filesize

                1.4MB

              • memory/3984-154-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-165-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-132-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-134-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-135-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-133-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-138-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-137-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-139-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-140-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-136-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-141-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-142-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-144-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-143-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-145-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-146-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-147-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-148-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-149-0x0000000000570000-0x0000000000590000-memory.dmp

                Filesize

                128KB

              • memory/3984-151-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-150-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-152-0x0000000005530000-0x0000000005A2E000-memory.dmp

                Filesize

                5.0MB

              • memory/3984-153-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-155-0x0000000004ED0000-0x0000000004F46000-memory.dmp

                Filesize

                472KB

              • memory/3984-131-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-156-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-157-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-158-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-160-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-161-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-163-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-162-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-159-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-164-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-127-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-166-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-167-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-168-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-169-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-170-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-171-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-172-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-173-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-174-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-175-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-177-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-179-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-180-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-181-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-178-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-176-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-182-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-196-0x0000000005F70000-0x000000000604A000-memory.dmp

                Filesize

                872KB

              • memory/3984-197-0x00000000061E0000-0x00000000061FE000-memory.dmp

                Filesize

                120KB

              • memory/3984-130-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-129-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-128-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-126-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-125-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-124-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-123-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-122-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-121-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-120-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-119-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-118-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-117-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-116-0x0000000077AC0000-0x0000000077C4E000-memory.dmp

                Filesize

                1.6MB

              • memory/3984-198-0x0000000006430000-0x000000000647A000-memory.dmp

                Filesize

                296KB

              • memory/3984-199-0x0000000006480000-0x00000000064CC000-memory.dmp

                Filesize

                304KB

              • memory/3984-238-0x0000000006910000-0x00000000069A2000-memory.dmp

                Filesize

                584KB