Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21/06/2022, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
bis.exe
Resource
win7-20220414-en
General
-
Target
bis.exe
-
Size
451KB
-
MD5
9e1bb80ff1f6f5181ed26c62ef3de29d
-
SHA1
5c37096275b5947dfd68ccacc92eec204fa73883
-
SHA256
a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448
-
SHA512
f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004
Malware Config
Extracted
xloader
2.9
rb1k
Hy3kKk3exSb8BwggZ6MfKxQ=
NCL+/Dy1jhSUG9mRm0U=
wWOomCbzt4pHcH22F16ZDMRcKw==
WTIg8VQo+NeSJsTaLk6M9XQi
GxTnP34PxKGMqI0aDg==
BCLmUMWYgpQ0hmDGRvcILQM=
ILk0ukAA71UFWNrW
aHq3rPmIgJpVF+C9GQ==
8jYg+GYnGycf+ufa9Fo=
gQpOLax1ZUbL5at4u1SkP/XMaS0=
s1abd4QIyia5Ta6zEUSM9XQi
JDL1dr1IE+a1q4zB
24b2gBbkpvG81Nh1rLjxJw==
U5KEePzSsY5a/WYuVdUXnycmbPcnk6RB
D+TYrgrRwtaL5YIUEQ==
T1gpjLMr70QZODL8/UOM9XQi
f3Efb+StKpP+MQ==
fUfDKVLlzfcCFgo=
23rI2NitbuCL
ypQDXuCwKpP+MQ==
HAb9/o1eLLQ9wSTfYYSH
dGQztBqhddBmAXhBXcxKFgs=
pot/UnwB2u3ASrJxrLjxJw==
u0T+cxPYr0QFWNrW
Xd4g6AvWeAiHFNmRm0U=
fqY0SI2eZ8o=
8drNzC++V3AVf2DUYR5ZxjZMexa6qwY=
nbJ3+p1pTrKCkI2W2WKmP/XMaS0=
2hALD5uTJQmW5YIUEQ==
xkOFeq85DZta4TTHqkaTsKRHWhWYuw==
oM7LtPFwVWgDawjY9lo=
I6fZxC063kHYasfIFUSM9XQi
3tSd2b+SQYRPWh4=
iQKA+Xs4IpIluCPfYYSH
WZeQeI4b9FYFWNrW
j4Etp+CtbuCL
wWGZaYoV9XsDjMeSwzZ1tqK0WhWYuw==
EmloL1XbangEJg==
yU6IU27/+OCqK5mc+D5pZzEXvksf
WZKSas6qakwYQB4bZaMfKxQ=
bPxAU5ReCj/E6Bmu2VI=
IOZn4Wky9gf+nyfw+Fo=
il/DFi65d1XWM96z2FA=
RtQFCV/SvsqI5YIUEQ==
n3sLWHwMx6QhefHiBg==
s1fVFTG+gQnLhOzE8nq9EMFmMg==
x6iSiQrLangEJg==
czynGrjNeuqB
96wda7Yz/9qL5YIUEQ==
cMAlpBKfasZ0knE2aKMfKxQ=
+b49sNMNangEJg==
ynKneOyojnL+HxwufAhbGocyQO8nk6RB
hsy9q0Ig6o7J5YIUEQ==
49iq9i7AWSj7EvjE9T/yIQ0=
sYxAhPrIi2QqnRrfYYSH
DAo7NXv96UD+qCnt+0SM9XQi
69TZxSrz4MxfcllPdaMfKxQ=
wIryVHQR+gzPXPIBWoh3DHEKLW0nk6RB
L6TuDuPkKpP+MQ==
S6Vr07qsKn06Pw==
fbiiiwzOangEJg==
CcAzujb9ytZvk5qm7D/yIQ0=
tAsA5EU4mfcCFgo=
0knRgKY39EwFWNrW
strictlynightowl.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 5 IoCs
resource yara_rule behavioral1/memory/1328-62-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1328-63-0x000000000041F6C0-mapping.dmp xloader behavioral1/memory/1328-65-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/936-73-0x0000000000080000-0x00000000000AC000-memory.dmp xloader behavioral1/memory/936-76-0x0000000000080000-0x00000000000AC000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run help.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DTXDDXWH5T0 = "C:\\Program Files (x86)\\Lwfylpf\\updateojshll20.exe" help.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation bis.exe -
Deletes itself 1 IoCs
pid Process 1960 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1948 set thread context of 1328 1948 bis.exe 29 PID 1328 set thread context of 1256 1328 bis.exe 14 PID 936 set thread context of 1256 936 help.exe 14 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lwfylpf\updateojshll20.exe help.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1948 bis.exe 1328 bis.exe 1328 bis.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1328 bis.exe 1328 bis.exe 1328 bis.exe 936 help.exe 936 help.exe 936 help.exe 936 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1948 bis.exe Token: SeDebugPrivilege 1328 bis.exe Token: SeDebugPrivilege 936 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1160 1948 bis.exe 28 PID 1948 wrote to memory of 1160 1948 bis.exe 28 PID 1948 wrote to memory of 1160 1948 bis.exe 28 PID 1948 wrote to memory of 1160 1948 bis.exe 28 PID 1948 wrote to memory of 1328 1948 bis.exe 29 PID 1948 wrote to memory of 1328 1948 bis.exe 29 PID 1948 wrote to memory of 1328 1948 bis.exe 29 PID 1948 wrote to memory of 1328 1948 bis.exe 29 PID 1948 wrote to memory of 1328 1948 bis.exe 29 PID 1948 wrote to memory of 1328 1948 bis.exe 29 PID 1948 wrote to memory of 1328 1948 bis.exe 29 PID 1256 wrote to memory of 936 1256 Explorer.EXE 30 PID 1256 wrote to memory of 936 1256 Explorer.EXE 30 PID 1256 wrote to memory of 936 1256 Explorer.EXE 30 PID 1256 wrote to memory of 936 1256 Explorer.EXE 30 PID 936 wrote to memory of 1960 936 help.exe 31 PID 936 wrote to memory of 1960 936 help.exe 31 PID 936 wrote to memory of 1960 936 help.exe 31 PID 936 wrote to memory of 1960 936 help.exe 31 PID 936 wrote to memory of 1976 936 help.exe 34 PID 936 wrote to memory of 1976 936 help.exe 34 PID 936 wrote to memory of 1976 936 help.exe 34 PID 936 wrote to memory of 1976 936 help.exe 34 PID 936 wrote to memory of 1976 936 help.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\bis.exe"C:\Users\Admin\AppData\Local\Temp\bis.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\bis.exe"C:\Users\Admin\AppData\Local\Temp\bis.exe"3⤵PID:1160
-
-
C:\Users\Admin\AppData\Local\Temp\bis.exe"C:\Users\Admin\AppData\Local\Temp\bis.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\bis.exe"3⤵
- Deletes itself
PID:1960
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1976
-
-