Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21/06/2022, 09:23

General

  • Target

    1.exe

  • Size

    176KB

  • MD5

    509edfdb29a62b6e704548051f8288d7

  • SHA1

    092709e1a4bdb9e154201f243faf7be0a6754806

  • SHA256

    61f7409c356d9376b580f156b4b775fb91aa34a4687642bc9c7f4673cffca0ca

  • SHA512

    10f97e788c0753de73f47ce30eb0617d84db1731e3279aa96343ce7fbf77b6ae6b073a6fad3dfafd26bbf10928a0ce1daf35aa382d8d2b717d182aab235ee954

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

uniz

Decoy

ZBCuBDslv1vmdg==

Tf0bKIL7UwC+XwBS

YQAj8CUa+qQn4NVV

c2VpeA0CV0kHeeq31nYPNgE=

Yhin8SpRfm1NbLm9nOThBw==

eyIn8RqE6k/h/YkDntqoMKVA

W/mS4B+Zbo6mZ6024Q==

96FIkNOqhgj5rKAYr7S/JxaIrKNEEg==

z4QXqB6NZViPQvPsHTgCGh6OaJ9DEAhD/Zw+pQ==

z3D/WJZrRZ9wJDa2GIMXEA==

sWh+QWdXHJePJ/l5/zU6iQNdX3UE

FL1V2Tmuv1vmdg==

IeL4/3li2MqV2ubg7g==

UPqU6i+W7FlT8Jizi83T

xFoDgOwNGwmcN0Q6GIMXEA==

M+T00gzvwwvEZnXypOfsKPBJzu70TAs=

JuD4/pF5R4qIiFWoGIMXEA==

fiy88SOceKo2PHU=

Tf+kJJDy0LB5sg7b73YPNgE=

952zrSIBT08QrIzqdJpPQ0Jq8yO1s2OpNg==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 4 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1296
    • C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:1520
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:876
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\1.exe"
        3⤵
        • Deletes itself
        PID:964
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1812
      • C:\Program Files (x86)\Ger1tiv_h\mfcer-p6tep.exe
        "C:\Program Files (x86)\Ger1tiv_h\mfcer-p6tep.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1564

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Ger1tiv_h\mfcer-p6tep.exe

            Filesize

            176KB

            MD5

            509edfdb29a62b6e704548051f8288d7

            SHA1

            092709e1a4bdb9e154201f243faf7be0a6754806

            SHA256

            61f7409c356d9376b580f156b4b775fb91aa34a4687642bc9c7f4673cffca0ca

            SHA512

            10f97e788c0753de73f47ce30eb0617d84db1731e3279aa96343ce7fbf77b6ae6b073a6fad3dfafd26bbf10928a0ce1daf35aa382d8d2b717d182aab235ee954

          • C:\Program Files (x86)\Ger1tiv_h\mfcer-p6tep.exe

            Filesize

            176KB

            MD5

            509edfdb29a62b6e704548051f8288d7

            SHA1

            092709e1a4bdb9e154201f243faf7be0a6754806

            SHA256

            61f7409c356d9376b580f156b4b775fb91aa34a4687642bc9c7f4673cffca0ca

            SHA512

            10f97e788c0753de73f47ce30eb0617d84db1731e3279aa96343ce7fbf77b6ae6b073a6fad3dfafd26bbf10928a0ce1daf35aa382d8d2b717d182aab235ee954

          • memory/876-62-0x0000000001D90000-0x0000000001E20000-memory.dmp

            Filesize

            576KB

          • memory/876-66-0x0000000076451000-0x0000000076453000-memory.dmp

            Filesize

            8KB

          • memory/876-59-0x0000000000210000-0x000000000021D000-memory.dmp

            Filesize

            52KB

          • memory/876-60-0x0000000001F20000-0x0000000002223000-memory.dmp

            Filesize

            3.0MB

          • memory/876-61-0x0000000000080000-0x00000000000AC000-memory.dmp

            Filesize

            176KB

          • memory/876-64-0x0000000000080000-0x00000000000AC000-memory.dmp

            Filesize

            176KB

          • memory/1296-63-0x0000000006240000-0x00000000062E4000-memory.dmp

            Filesize

            656KB

          • memory/1296-65-0x0000000006240000-0x00000000062E4000-memory.dmp

            Filesize

            656KB

          • memory/1296-56-0x00000000072D0000-0x0000000007476000-memory.dmp

            Filesize

            1.6MB

          • memory/1520-54-0x00000000008B0000-0x0000000000BB3000-memory.dmp

            Filesize

            3.0MB

          • memory/1520-55-0x0000000000270000-0x0000000000281000-memory.dmp

            Filesize

            68KB

          • memory/1564-69-0x0000000000880000-0x0000000000B83000-memory.dmp

            Filesize

            3.0MB