Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21/06/2022, 10:21

General

  • Target

    vbc (10).exe

  • Size

    963KB

  • MD5

    83dd3acd8f3e455bfd2c4711453399c3

  • SHA1

    8895c917c9a3157939036647ba402f02d98f29e4

  • SHA256

    ccc5f7c2dcf83d72150071b31ff3036834f0d26544e2c2c274bce95d234b14ea

  • SHA512

    72fee0861dad6d8f44f450e00950bb1c486961b7f114d822f1e5e0335c7214800b1c8242a35f409220eac72f8b2dfd56a238c5e10be13d52507e521daa5cb2d2

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

gd9m

Decoy

screens.ma

coachingdiary.com

cannabisconsultant.xyz

sirenonthemoon.com

gabrielatrejo.com

blumenladentampa.com

sturisticosadmcancun.com

qdygo.net

nubearies.com

thedestinationcrafter.com

fastblacktv.com

sanakatha.com

birdviewsecurityandshipping.com

waterfilterhub.xyz

92658.top

xigen.xyz

barikadcrew.com

herzogbjj.com

veminis.com

thnawya.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3152
    • C:\Users\Admin\AppData\Local\Temp\vbc (10).exe
      "C:\Users\Admin\AppData\Local\Temp\vbc (10).exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Users\Admin\AppData\Local\Temp\vbc (10).exe
        "C:\Users\Admin\AppData\Local\Temp\vbc (10).exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Windows\SysWOW64\help.exe
          "C:\Windows\SysWOW64\help.exe"
          4⤵
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Drops file in Program Files directory
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:116
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\vbc (10).exe"
            5⤵
              PID:2236
            • C:\Windows\SysWOW64\cmd.exe
              /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
              5⤵
                PID:1948
              • C:\Windows\SysWOW64\cmd.exe
                /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
                5⤵
                  PID:4620
                • C:\Program Files\Mozilla Firefox\Firefox.exe
                  "C:\Program Files\Mozilla Firefox\Firefox.exe"
                  5⤵
                    PID:3144
            • C:\Windows\SysWOW64\autochk.exe
              "C:\Windows\SysWOW64\autochk.exe"
              2⤵
                PID:4964
              • C:\Windows\SysWOW64\autochk.exe
                "C:\Windows\SysWOW64\autochk.exe"
                2⤵
                  PID:1360

              Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\DB1

                      Filesize

                      40KB

                      MD5

                      b608d407fc15adea97c26936bc6f03f6

                      SHA1

                      953e7420801c76393902c0d6bb56148947e41571

                      SHA256

                      b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                      SHA512

                      cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

                    • C:\Users\Admin\AppData\Local\Temp\DB1

                      Filesize

                      48KB

                      MD5

                      349e6eb110e34a08924d92f6b334801d

                      SHA1

                      bdfb289daff51890cc71697b6322aa4b35ec9169

                      SHA256

                      c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                      SHA512

                      2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                    • memory/116-154-0x0000000000480000-0x00000000004AB000-memory.dmp

                      Filesize

                      172KB

                    • memory/116-149-0x0000000000480000-0x00000000004AB000-memory.dmp

                      Filesize

                      172KB

                    • memory/116-152-0x0000000000B10000-0x0000000000BA0000-memory.dmp

                      Filesize

                      576KB

                    • memory/116-151-0x0000000000C70000-0x0000000000FBA000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/116-148-0x0000000000600000-0x0000000000607000-memory.dmp

                      Filesize

                      28KB

                    • memory/1372-133-0x00000000058A0000-0x000000000593C000-memory.dmp

                      Filesize

                      624KB

                    • memory/1372-134-0x00000000072D0000-0x00000000072DA000-memory.dmp

                      Filesize

                      40KB

                    • memory/1372-135-0x000000000EE30000-0x000000000EE52000-memory.dmp

                      Filesize

                      136KB

                    • memory/1372-132-0x0000000005800000-0x0000000005892000-memory.dmp

                      Filesize

                      584KB

                    • memory/1372-131-0x0000000005DB0000-0x0000000006354000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/1372-130-0x0000000000E20000-0x0000000000F16000-memory.dmp

                      Filesize

                      984KB

                    • memory/2536-146-0x0000000000400000-0x000000000042B000-memory.dmp

                      Filesize

                      172KB

                    • memory/2536-144-0x00000000011B0000-0x00000000011C1000-memory.dmp

                      Filesize

                      68KB

                    • memory/2536-141-0x0000000000E40000-0x0000000000E51000-memory.dmp

                      Filesize

                      68KB

                    • memory/2536-140-0x0000000001310000-0x000000000165A000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2536-139-0x0000000000400000-0x000000000042B000-memory.dmp

                      Filesize

                      172KB

                    • memory/2536-137-0x0000000000400000-0x000000000042B000-memory.dmp

                      Filesize

                      172KB

                    • memory/3152-145-0x00000000084D0000-0x00000000085EC000-memory.dmp

                      Filesize

                      1.1MB

                    • memory/3152-142-0x0000000002B50000-0x0000000002CA1000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/3152-153-0x00000000085F0000-0x00000000086B7000-memory.dmp

                      Filesize

                      796KB

                    • memory/3152-155-0x00000000085F0000-0x00000000086B7000-memory.dmp

                      Filesize

                      796KB