Resubmissions

21/06/2022, 09:20

220621-lazeyscffm 10

Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21/06/2022, 09:20

General

  • Target

    pay2.exe

  • Size

    174KB

  • MD5

    4b052ae067d179b1e9626c250771002e

  • SHA1

    a37c079cc492f9ebcb5fefc440db929007e3f409

  • SHA256

    c4692b54a5619346cd90557fc71a3bcb9a5712d40b5e30411a87f4bec4697005

  • SHA512

    ea186cfbaac1e7fbaff049c258eb3b10c6d11fb01415dc2c4e4292637cba825697e360170803338d451aa333d6c7a4e78223d8c37f73a7ab6a70b65a7e656ce2

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

utg6

Decoy

HH9H3kXZHIk0wrXfJq4s5Q==

dJojMwcUlkY3/12Ghl4=

M97sg6hotTOvNY1D

6o+YPIQARtqPHA4sKdmWYke8FA==

Pt71lrWLDblvQJ9A

K0fU6/BseTox+kSSmYQw5NtN00EV7tXr

4sohLE0CeRrTl+2X03jpYke8FA==

zrcKky6asFs+yUeWmQ==

VodJdmzh+A==

gobc7RDsOEAw9A==

xEYVn8uhKPPkPWuJo43QVuWhzgLM

Fw9Ybr9DXRz9jnd/jXvyYke8FA==

VCyIpJ9WjQS9AUudt5mWvMjCzE4=

0a6vT2kQTs1+SYepk6NO

TGCqvhzKUAj3RWvPX/5G

h4bU7i39XUJV4szsQt9e/A==

vwqYIIH/DLW3bpeqo3HpYke8FA==

vxbocZI8hKNcZb9Moli2Yv0dHg==

7JCQHUYhm19m7lrqPADuDrOhzgLM

gJjwBFXqM6BPYIxcaVY=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\pay2.exe
      "C:\Users\Admin\AppData\Local\Temp\pay2.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:800
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\pay2.exe"
        3⤵
        • Deletes itself
        PID:1744
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:460
      • C:\Program Files (x86)\Nljod5z\user7nmtbv.exe
        "C:\Program Files (x86)\Nljod5z\user7nmtbv.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:872

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Nljod5z\user7nmtbv.exe

            Filesize

            174KB

            MD5

            4b052ae067d179b1e9626c250771002e

            SHA1

            a37c079cc492f9ebcb5fefc440db929007e3f409

            SHA256

            c4692b54a5619346cd90557fc71a3bcb9a5712d40b5e30411a87f4bec4697005

            SHA512

            ea186cfbaac1e7fbaff049c258eb3b10c6d11fb01415dc2c4e4292637cba825697e360170803338d451aa333d6c7a4e78223d8c37f73a7ab6a70b65a7e656ce2

          • C:\Program Files (x86)\Nljod5z\user7nmtbv.exe

            Filesize

            174KB

            MD5

            4b052ae067d179b1e9626c250771002e

            SHA1

            a37c079cc492f9ebcb5fefc440db929007e3f409

            SHA256

            c4692b54a5619346cd90557fc71a3bcb9a5712d40b5e30411a87f4bec4697005

            SHA512

            ea186cfbaac1e7fbaff049c258eb3b10c6d11fb01415dc2c4e4292637cba825697e360170803338d451aa333d6c7a4e78223d8c37f73a7ab6a70b65a7e656ce2

          • memory/800-55-0x0000000000170000-0x0000000000181000-memory.dmp

            Filesize

            68KB

          • memory/800-54-0x0000000000A50000-0x0000000000D53000-memory.dmp

            Filesize

            3.0MB

          • memory/872-69-0x00000000007E0000-0x0000000000AE3000-memory.dmp

            Filesize

            3.0MB

          • memory/1212-65-0x0000000003A30000-0x0000000003AE7000-memory.dmp

            Filesize

            732KB

          • memory/1212-56-0x0000000004A40000-0x0000000004B7A000-memory.dmp

            Filesize

            1.2MB

          • memory/1212-63-0x0000000003A30000-0x0000000003AE7000-memory.dmp

            Filesize

            732KB

          • memory/2024-62-0x0000000000960000-0x00000000009F0000-memory.dmp

            Filesize

            576KB

          • memory/2024-64-0x0000000000080000-0x00000000000AC000-memory.dmp

            Filesize

            176KB

          • memory/2024-66-0x00000000765F1000-0x00000000765F3000-memory.dmp

            Filesize

            8KB

          • memory/2024-61-0x0000000000080000-0x00000000000AC000-memory.dmp

            Filesize

            176KB

          • memory/2024-60-0x0000000002210000-0x0000000002513000-memory.dmp

            Filesize

            3.0MB

          • memory/2024-58-0x0000000000E00000-0x0000000000E05000-memory.dmp

            Filesize

            20KB