Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-06-2022 04:21
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
502KB
-
MD5
6237a36be522069ff7f84128c2cbb5c4
-
SHA1
2c57d875e90ef11903529ec81862aa01e8945129
-
SHA256
8261a237ce6bd2bfae4c46b2e8a338b00ea9047f1fa6c5cc9ac1e6d00f0a3a06
-
SHA512
c36ae59fca8d0345b1ccf19838894ca2103cab1222c2e2f00f56e57d26d50cbeda24034e5dba05bd2d7cb533997b2235a4adddc992d5069938287d1bbad0855e
Malware Config
Extracted
xloader
2.9
iewb
n8FLlgIlb1rSEg5hJ9xMbw4hcmR38Q==
5vIAIY+pt81OtWs+FdIEdk7Y
LHIKc+oWGIQUUlfAAtEEdk7Y
ePM/cX2jvHrS
5hvPEw22+fdvmJz3C8FIVq0=
mb9EeX2jvHrS
Dx2zIYNvfjo8VUo5
6jVPnyJekv2RAc4gLKNwEqQ=
KWatHyjdE5Gj1Ng=
t9lk70gzUAZty4qjbVjF
6eUBeFPzKBWT125BFNIEdk7Y
dZUXOIyqTJGj1Ng=
iL3TVh2Jl5QVStnzxcAhIL8=
J1prtyklUfZGR/xDD71IbkWRd2yx
s9FgCOBRW9bU0Y6jbVjF
RYCbQDzcFBhcylgu
Fl0BV/8RJm6F9QRg8LXXTLo=
0dhumHzrCCZ3wdQg7nFF1AlL6Tk=
xvL+iL6wwX+/wH9K4lbZ/A==
N0lVceIFD5Gj1Ng=
5/mnQbHhJ7IzcYjyQbXXTLo=
luHuIKrfNeUkJOfRV0dA8o3Ghkt95g==
yuh2thpBWtHl2ZV48rXXTLo=
ADcuaODkD5eytord4lbZ/A==
PIWRAgq8/zx4aipDyILc
TdUPJBksRZU=
NorCQjrrH5Gj1Ng=
WXUOku0EDZGj1Ng=
4w8mrX8lanCcoWZLU0SkkkSRd2yx
KIYkq/0QN5gPTFK37XszY0fa
s8lIykhdVZjlEA1g8LXXTLo=
AkBw4LE9RQNHkyRsMQ==
fLzVWEjyMarikyRsMQ==
6j1f2ZsFFRpcylgu
zu3YwbBReoIuUh1vdsGonTCDfw==
EGD0PEju53oDSuwu9765d/4KSkXU3Qxh
rc0aZhksRZU=
Un//ZcCsqyaNtEcnt6mLu7Lqdw==
V4Eqwh4FEHqIflW508EYzYSbOeC5
EiWpwJgAFRV5e1r60cAEdk7Y
VW8Pf9PN65HU1otP4lbZ/A==
FFdOyJcMGxpcylgu
KztLpY85vJkLFw==
yh8vtO4GRPQ2kyRsMQ==
qMfrSiqZvghLUyRy/7XXTLo=
eKTGPwmf3swEq2Y3
aoseYSTrlPsvGQ==
Z6tKw0RfgS5+1o6jbVjF
CyU0azDFBZGj1Ng=
7Cy+5co/ZZbhC8dW6eo=
LXmN0EJimQWHylwnbTS6afIlJZHj+Q==
2R2cFWiX1hlZYz2UKh4i12ikiTP55p5Bfg==
jqHcD+eAi5EYlVrJm0TN
cqO55WilyvQ9mG1P4lbZ/A==
BERqtpY6pZDbB8dW6eo=
VpzDHQBueZvY24qjbVjF
OWUELQ6s28NVxom7evrIPfCLfw==
5iO6Dg619fIVQz+Q3I+ZMdmwry4=
d6GiFh7QJaHO2Jxz8bXXTLo=
NlFh6bdVeihxxT1MH+A+TL3MaA==
0PWJHpPJ9zh3nasMO8FIVq0=
19Fom6FBSQ1QrMU=
aYWBmw6431DfHsdW6eo=
Jj7U++2X3M4Eq2Y3
mounscape.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/592-63-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/592-64-0x000000000041F840-mapping.dmp xloader behavioral1/memory/592-66-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1588-74-0x0000000000080000-0x00000000000AC000-memory.dmp xloader behavioral1/memory/1588-78-0x0000000000080000-0x00000000000AC000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\International\Geo\Nation tmp.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1980 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.execontrol.exedescription pid process target process PID 1892 set thread context of 592 1892 tmp.exe tmp.exe PID 592 set thread context of 1204 592 tmp.exe Explorer.EXE PID 1588 set thread context of 1204 1588 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
tmp.execontrol.exepid process 592 tmp.exe 592 tmp.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe 1588 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tmp.execontrol.exepid process 592 tmp.exe 592 tmp.exe 592 tmp.exe 1588 control.exe 1588 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.execontrol.exedescription pid process Token: SeDebugPrivilege 592 tmp.exe Token: SeDebugPrivilege 1588 control.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.exeExplorer.EXEcontrol.exedescription pid process target process PID 1892 wrote to memory of 592 1892 tmp.exe tmp.exe PID 1892 wrote to memory of 592 1892 tmp.exe tmp.exe PID 1892 wrote to memory of 592 1892 tmp.exe tmp.exe PID 1892 wrote to memory of 592 1892 tmp.exe tmp.exe PID 1892 wrote to memory of 592 1892 tmp.exe tmp.exe PID 1892 wrote to memory of 592 1892 tmp.exe tmp.exe PID 1892 wrote to memory of 592 1892 tmp.exe tmp.exe PID 1204 wrote to memory of 1588 1204 Explorer.EXE control.exe PID 1204 wrote to memory of 1588 1204 Explorer.EXE control.exe PID 1204 wrote to memory of 1588 1204 Explorer.EXE control.exe PID 1204 wrote to memory of 1588 1204 Explorer.EXE control.exe PID 1588 wrote to memory of 1980 1588 control.exe cmd.exe PID 1588 wrote to memory of 1980 1588 control.exe cmd.exe PID 1588 wrote to memory of 1980 1588 control.exe cmd.exe PID 1588 wrote to memory of 1980 1588 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/592-68-0x00000000001B0000-0x00000000001C1000-memory.dmpFilesize
68KB
-
memory/592-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/592-67-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/592-66-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/592-64-0x000000000041F840-mapping.dmp
-
memory/592-60-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/592-63-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1204-79-0x00000000061F0000-0x000000000631A000-memory.dmpFilesize
1.2MB
-
memory/1204-77-0x00000000061F0000-0x000000000631A000-memory.dmpFilesize
1.2MB
-
memory/1204-69-0x0000000006080000-0x00000000061E9000-memory.dmpFilesize
1.4MB
-
memory/1588-76-0x0000000000520000-0x00000000005B0000-memory.dmpFilesize
576KB
-
memory/1588-75-0x00000000021A0000-0x00000000024A3000-memory.dmpFilesize
3.0MB
-
memory/1588-78-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/1588-73-0x0000000000470000-0x000000000048F000-memory.dmpFilesize
124KB
-
memory/1588-70-0x0000000000000000-mapping.dmp
-
memory/1588-74-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/1892-59-0x0000000000AA0000-0x0000000000AD2000-memory.dmpFilesize
200KB
-
memory/1892-54-0x0000000000D10000-0x0000000000D94000-memory.dmpFilesize
528KB
-
memory/1892-58-0x0000000005B20000-0x0000000005B8A000-memory.dmpFilesize
424KB
-
memory/1892-57-0x00000000005A0000-0x00000000005AA000-memory.dmpFilesize
40KB
-
memory/1892-56-0x0000000000570000-0x000000000058C000-memory.dmpFilesize
112KB
-
memory/1892-55-0x00000000753E1000-0x00000000753E3000-memory.dmpFilesize
8KB
-
memory/1980-72-0x0000000000000000-mapping.dmp