Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21/06/2022, 09:23

General

  • Target

    1.exe

  • Size

    176KB

  • MD5

    509edfdb29a62b6e704548051f8288d7

  • SHA1

    092709e1a4bdb9e154201f243faf7be0a6754806

  • SHA256

    61f7409c356d9376b580f156b4b775fb91aa34a4687642bc9c7f4673cffca0ca

  • SHA512

    10f97e788c0753de73f47ce30eb0617d84db1731e3279aa96343ce7fbf77b6ae6b073a6fad3dfafd26bbf10928a0ce1daf35aa382d8d2b717d182aab235ee954

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

uniz

Decoy

ZBCuBDslv1vmdg==

Tf0bKIL7UwC+XwBS

YQAj8CUa+qQn4NVV

c2VpeA0CV0kHeeq31nYPNgE=

Yhin8SpRfm1NbLm9nOThBw==

eyIn8RqE6k/h/YkDntqoMKVA

W/mS4B+Zbo6mZ6024Q==

96FIkNOqhgj5rKAYr7S/JxaIrKNEEg==

z4QXqB6NZViPQvPsHTgCGh6OaJ9DEAhD/Zw+pQ==

z3D/WJZrRZ9wJDa2GIMXEA==

sWh+QWdXHJePJ/l5/zU6iQNdX3UE

FL1V2Tmuv1vmdg==

IeL4/3li2MqV2ubg7g==

UPqU6i+W7FlT8Jizi83T

xFoDgOwNGwmcN0Q6GIMXEA==

M+T00gzvwwvEZnXypOfsKPBJzu70TAs=

JuD4/pF5R4qIiFWoGIMXEA==

fiy88SOceKo2PHU=

Tf+kJJDy0LB5sg7b73YPNgE=

952zrSIBT08QrIzqdJpPQ0Jq8yO1s2OpNg==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

  • Xloader Payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:1088
    • C:\Windows\SysWOW64\NETSTAT.EXE
      "C:\Windows\SysWOW64\NETSTAT.EXE"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Gathers network information
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\1.exe"
        3⤵
          PID:1988
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:3992
          • C:\Windows\SysWOW64\cmd.exe
            /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
            3⤵
              PID:2960
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:4448
            • C:\Program Files (x86)\Dqdf8\chkdskp6ql.exe
              "C:\Program Files (x86)\Dqdf8\chkdskp6ql.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4928

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\Dqdf8\chkdskp6ql.exe

                  Filesize

                  176KB

                  MD5

                  509edfdb29a62b6e704548051f8288d7

                  SHA1

                  092709e1a4bdb9e154201f243faf7be0a6754806

                  SHA256

                  61f7409c356d9376b580f156b4b775fb91aa34a4687642bc9c7f4673cffca0ca

                  SHA512

                  10f97e788c0753de73f47ce30eb0617d84db1731e3279aa96343ce7fbf77b6ae6b073a6fad3dfafd26bbf10928a0ce1daf35aa382d8d2b717d182aab235ee954

                • C:\Program Files (x86)\Dqdf8\chkdskp6ql.exe

                  Filesize

                  176KB

                  MD5

                  509edfdb29a62b6e704548051f8288d7

                  SHA1

                  092709e1a4bdb9e154201f243faf7be0a6754806

                  SHA256

                  61f7409c356d9376b580f156b4b775fb91aa34a4687642bc9c7f4673cffca0ca

                  SHA512

                  10f97e788c0753de73f47ce30eb0617d84db1731e3279aa96343ce7fbf77b6ae6b073a6fad3dfafd26bbf10928a0ce1daf35aa382d8d2b717d182aab235ee954

                • C:\Users\Admin\AppData\Local\Temp\DB1

                  Filesize

                  40KB

                  MD5

                  b608d407fc15adea97c26936bc6f03f6

                  SHA1

                  953e7420801c76393902c0d6bb56148947e41571

                  SHA256

                  b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                  SHA512

                  cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

                • C:\Users\Admin\AppData\Local\Temp\DB1

                  Filesize

                  48KB

                  MD5

                  349e6eb110e34a08924d92f6b334801d

                  SHA1

                  bdfb289daff51890cc71697b6322aa4b35ec9169

                  SHA256

                  c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                  SHA512

                  2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                • memory/1088-131-0x00000000015F0000-0x0000000001601000-memory.dmp

                  Filesize

                  68KB

                • memory/1088-130-0x00000000010F0000-0x000000000143A000-memory.dmp

                  Filesize

                  3.3MB

                • memory/3084-132-0x0000000002B10000-0x0000000002C5B000-memory.dmp

                  Filesize

                  1.3MB

                • memory/3084-139-0x0000000002E00000-0x0000000002EC4000-memory.dmp

                  Filesize

                  784KB

                • memory/3084-141-0x0000000002E00000-0x0000000002EC4000-memory.dmp

                  Filesize

                  784KB

                • memory/4644-136-0x0000000000E30000-0x000000000117A000-memory.dmp

                  Filesize

                  3.3MB

                • memory/4644-140-0x0000000000340000-0x000000000036C000-memory.dmp

                  Filesize

                  176KB

                • memory/4644-138-0x0000000000B50000-0x0000000000BE0000-memory.dmp

                  Filesize

                  576KB

                • memory/4644-137-0x0000000000340000-0x000000000036C000-memory.dmp

                  Filesize

                  176KB

                • memory/4644-135-0x00000000003D0000-0x00000000003DB000-memory.dmp

                  Filesize

                  44KB

                • memory/4928-149-0x00000000018C0000-0x0000000001C0A000-memory.dmp

                  Filesize

                  3.3MB