Analysis
- max time kernel
147s - max time network
155s - platform
windows7_x64 - resource
win7-20220414-en - submitted
21/06/2022, 09:20
General
- Target pay2.exe
- Size 174KB
- Sample220621-lazeyscffm
- SHA256 c4692b54a5619346cd90557fc71a3bcb9a5712d40b5e30411a87f4bec4697005
Malware Config
Extracted
-
xloader
-
2.8
-
utg6
-
HH9H3kXZHIk0wrXfJq4s5Q==
-
dJojMwcUlkY3/12Ghl4=
-
M97sg6hotTOvNY1D
-
6o+YPIQARtqPHA4sKdmWYke8FA==
-
Pt71lrWLDblvQJ9A
-
K0fU6/BseTox+kSSmYQw5NtN00EV7tXr
-
4sohLE0CeRrTl+2X03jpYke8FA==
-
zrcKky6asFs+yUeWmQ==
-
VodJdmzh+A==
-
gobc7RDsOEAw9A==
-
xEYVn8uhKPPkPWuJo43QVuWhzgLM
-
Fw9Ybr9DXRz9jnd/jXvyYke8FA==
-
VCyIpJ9WjQS9AUudt5mWvMjCzE4=
-
0a6vT2kQTs1+SYepk6NO
-
TGCqvhzKUAj3RWvPX/5G
-
h4bU7i39XUJV4szsQt9e/A==
-
vwqYIIH/DLW3bpeqo3HpYke8FA==
-
vxbocZI8hKNcZb9Moli2Yv0dHg==
-
7JCQHUYhm19m7lrqPADuDrOhzgLM
-
gJjwBFXqM6BPYIxcaVY=
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 4 IoCs
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Program Files directory 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pay2.exe"C:\Users\Admin\AppData\Local\Temp\pay2.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pay2.exe"3⤵
- Deletes itself
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
-
C:\Program Files (x86)\Nljod5z\user7nmtbv.exe"C:\Program Files (x86)\Nljod5z\user7nmtbv.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
user7nmtbv.exe
user7nmtbv.exe
memory/800-55-0x0000000000170000-0x0000000000181000-memory.dmp
memory/800-54-0x0000000000A50000-0x0000000000D53000-memory.dmp
memory/872-69-0x00000000007E0000-0x0000000000AE3000-memory.dmp
memory/1212-65-0x0000000003A30000-0x0000000003AE7000-memory.dmp
memory/1212-56-0x0000000004A40000-0x0000000004B7A000-memory.dmp
memory/1212-63-0x0000000003A30000-0x0000000003AE7000-memory.dmp
memory/2024-62-0x0000000000960000-0x00000000009F0000-memory.dmp
memory/2024-64-0x0000000000080000-0x00000000000AC000-memory.dmp
memory/2024-66-0x00000000765F1000-0x00000000765F3000-memory.dmp
memory/2024-61-0x0000000000080000-0x00000000000AC000-memory.dmp
memory/2024-60-0x0000000002210000-0x0000000002513000-memory.dmp
memory/2024-58-0x0000000000E00000-0x0000000000E05000-memory.dmp