Resubmissions

21/06/2022, 09:20

220621-lazeyscffm 10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21/06/2022, 09:20

General

  • Target

    pay2.exe

  • Size

    174KB

  • MD5

    4b052ae067d179b1e9626c250771002e

  • SHA1

    a37c079cc492f9ebcb5fefc440db929007e3f409

  • SHA256

    c4692b54a5619346cd90557fc71a3bcb9a5712d40b5e30411a87f4bec4697005

  • SHA512

    ea186cfbaac1e7fbaff049c258eb3b10c6d11fb01415dc2c4e4292637cba825697e360170803338d451aa333d6c7a4e78223d8c37f73a7ab6a70b65a7e656ce2

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

utg6

Decoy

HH9H3kXZHIk0wrXfJq4s5Q==

dJojMwcUlkY3/12Ghl4=

M97sg6hotTOvNY1D

6o+YPIQARtqPHA4sKdmWYke8FA==

Pt71lrWLDblvQJ9A

K0fU6/BseTox+kSSmYQw5NtN00EV7tXr

4sohLE0CeRrTl+2X03jpYke8FA==

zrcKky6asFs+yUeWmQ==

VodJdmzh+A==

gobc7RDsOEAw9A==

xEYVn8uhKPPkPWuJo43QVuWhzgLM

Fw9Ybr9DXRz9jnd/jXvyYke8FA==

VCyIpJ9WjQS9AUudt5mWvMjCzE4=

0a6vT2kQTs1+SYepk6NO

TGCqvhzKUAj3RWvPX/5G

h4bU7i39XUJV4szsQt9e/A==

vwqYIIH/DLW3bpeqo3HpYke8FA==

vxbocZI8hKNcZb9Moli2Yv0dHg==

7JCQHUYhm19m7lrqPADuDrOhzgLM

gJjwBFXqM6BPYIxcaVY=

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

  • Xloader Payload 4 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Users\Admin\AppData\Local\Temp\pay2.exe
      "C:\Users\Admin\AppData\Local\Temp\pay2.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:1868
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:664
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\pay2.exe"
        3⤵
          PID:4548
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:2444
          • C:\Windows\SysWOW64\cmd.exe
            /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
            3⤵
              PID:3712
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:4944
            • C:\Program Files (x86)\D9r0tsbm\8pxdufwvxg4rtb.exe
              "C:\Program Files (x86)\D9r0tsbm\8pxdufwvxg4rtb.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:952

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\D9r0tsbm\8pxdufwvxg4rtb.exe

                  Filesize

                  174KB

                  MD5

                  4b052ae067d179b1e9626c250771002e

                  SHA1

                  a37c079cc492f9ebcb5fefc440db929007e3f409

                  SHA256

                  c4692b54a5619346cd90557fc71a3bcb9a5712d40b5e30411a87f4bec4697005

                  SHA512

                  ea186cfbaac1e7fbaff049c258eb3b10c6d11fb01415dc2c4e4292637cba825697e360170803338d451aa333d6c7a4e78223d8c37f73a7ab6a70b65a7e656ce2

                • C:\Program Files (x86)\D9r0tsbm\8pxdufwvxg4rtb.exe

                  Filesize

                  174KB

                  MD5

                  4b052ae067d179b1e9626c250771002e

                  SHA1

                  a37c079cc492f9ebcb5fefc440db929007e3f409

                  SHA256

                  c4692b54a5619346cd90557fc71a3bcb9a5712d40b5e30411a87f4bec4697005

                  SHA512

                  ea186cfbaac1e7fbaff049c258eb3b10c6d11fb01415dc2c4e4292637cba825697e360170803338d451aa333d6c7a4e78223d8c37f73a7ab6a70b65a7e656ce2

                • C:\Users\Admin\AppData\Local\Temp\DB1

                  Filesize

                  40KB

                  MD5

                  b608d407fc15adea97c26936bc6f03f6

                  SHA1

                  953e7420801c76393902c0d6bb56148947e41571

                  SHA256

                  b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                  SHA512

                  cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

                • C:\Users\Admin\AppData\Local\Temp\DB1

                  Filesize

                  48KB

                  MD5

                  349e6eb110e34a08924d92f6b334801d

                  SHA1

                  bdfb289daff51890cc71697b6322aa4b35ec9169

                  SHA256

                  c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                  SHA512

                  2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                • memory/664-140-0x0000000002FB0000-0x0000000003040000-memory.dmp

                  Filesize

                  576KB

                • memory/664-134-0x0000000000C00000-0x0000000000C57000-memory.dmp

                  Filesize

                  348KB

                • memory/664-135-0x0000000000F30000-0x0000000000F5C000-memory.dmp

                  Filesize

                  176KB

                • memory/664-137-0x0000000003420000-0x000000000376A000-memory.dmp

                  Filesize

                  3.3MB

                • memory/664-139-0x0000000000F30000-0x0000000000F5C000-memory.dmp

                  Filesize

                  176KB

                • memory/952-150-0x00000000016C0000-0x0000000001A0A000-memory.dmp

                  Filesize

                  3.3MB

                • memory/1868-130-0x0000000000D60000-0x00000000010AA000-memory.dmp

                  Filesize

                  3.3MB

                • memory/1868-131-0x0000000000D10000-0x0000000000D21000-memory.dmp

                  Filesize

                  68KB

                • memory/3168-141-0x0000000007EF0000-0x000000000802F000-memory.dmp

                  Filesize

                  1.2MB

                • memory/3168-142-0x0000000007EF0000-0x000000000802F000-memory.dmp

                  Filesize

                  1.2MB

                • memory/3168-138-0x0000000002820000-0x0000000002908000-memory.dmp

                  Filesize

                  928KB

                • memory/3168-132-0x0000000002820000-0x0000000002908000-memory.dmp

                  Filesize

                  928KB