Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    27-06-2022 14:14

General

  • Target

    shipping document.exe

  • Size

    521KB

  • MD5

    557350a46a849eb9ae8bc28a629bf3d5

  • SHA1

    8a773187553730b62bc9ba58457b8a97523f953e

  • SHA256

    576d080b4cab07bd5c3ef3e5d6a222b91744368ed837a3e56eb89772c1b5a1de

  • SHA512

    aee4d4881f1d20b7837f690291702c7ead7c6900f0a68fa29f6c5fbd06fc91d7d13f893b70543c172d3a3732d47262aeca3209af81cc396eddc3dd3412ccad64

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

pdrq

Decoy

welchsunstar.com

mppservicesllc.com

wiresofteflon.com

brabov.xyz

compnonoch.site

yourbuilderworks.com

iamsamirahman.com

eriqoes.com

eastudio.design

skyearth-est.com

teethfitness.com

razaancreates.com

shfbfs.com

joyfulbrokekids.com

kjbolden.com

howirep.com

deedeesmainecoons.website

e-powair.com

aheatea.com

shalfey0009.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Xloader Payload 5 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\shipping document.exe
      "C:\Users\Admin\AppData\Local\Temp\shipping document.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Maps connected drives based on registry
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ylJHrC.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:880
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ylJHrC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5320.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:1764
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1568
    • C:\Windows\SysWOW64\cmstp.exe
      "C:\Windows\SysWOW64\cmstp.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:1864
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:872

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Virtualization/Sandbox Evasion

      2
      T1497

      Modify Registry

      2
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      4
      T1012

      Virtualization/Sandbox Evasion

      2
      T1497

      System Information Discovery

      3
      T1082

      Peripheral Device Discovery

      1
      T1120

      Collection

      Data from Local System

      1
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp5320.tmp
        Filesize

        1KB

        MD5

        76528946f81f9a9f024ad894a7111791

        SHA1

        db8457138b370b16eae78188fe78afd6423d53fe

        SHA256

        60236db418b06321513ab90aa40899cd9b9587cfdd05cea97e60302d0f2277ec

        SHA512

        5d473a9cc12220e63111965462df7adfb8c03b297beaccedbdd0444413b9ad0b7502f4c89150e434fe65278ab4095327516308aced3c13cd686d84e293b7047f

      • memory/880-70-0x000000006E810000-0x000000006EDBB000-memory.dmp
        Filesize

        5.7MB

      • memory/880-59-0x0000000000000000-mapping.dmp
      • memory/1256-84-0x00000000068F0000-0x0000000006A4B000-memory.dmp
        Filesize

        1.4MB

      • memory/1256-82-0x00000000068F0000-0x0000000006A4B000-memory.dmp
        Filesize

        1.4MB

      • memory/1256-74-0x0000000004320000-0x000000000442A000-memory.dmp
        Filesize

        1.0MB

      • memory/1568-72-0x0000000000A20000-0x0000000000D23000-memory.dmp
        Filesize

        3.0MB

      • memory/1568-73-0x00000000001A0000-0x00000000001B1000-memory.dmp
        Filesize

        68KB

      • memory/1568-71-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

      • memory/1568-65-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

      • memory/1568-64-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

      • memory/1568-67-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

      • memory/1568-68-0x000000000041F270-mapping.dmp
      • memory/1724-75-0x0000000000000000-mapping.dmp
      • memory/1724-81-0x0000000001D80000-0x0000000001E10000-memory.dmp
        Filesize

        576KB

      • memory/1724-83-0x00000000000F0000-0x000000000011B000-memory.dmp
        Filesize

        172KB

      • memory/1724-80-0x0000000002050000-0x0000000002353000-memory.dmp
        Filesize

        3.0MB

      • memory/1724-79-0x00000000000F0000-0x000000000011B000-memory.dmp
        Filesize

        172KB

      • memory/1724-78-0x0000000000640000-0x0000000000658000-memory.dmp
        Filesize

        96KB

      • memory/1764-60-0x0000000000000000-mapping.dmp
      • memory/1864-77-0x0000000000000000-mapping.dmp
      • memory/1948-54-0x0000000000A60000-0x0000000000AE8000-memory.dmp
        Filesize

        544KB

      • memory/1948-57-0x0000000000550000-0x000000000055A000-memory.dmp
        Filesize

        40KB

      • memory/1948-58-0x0000000005B00000-0x0000000005B6A000-memory.dmp
        Filesize

        424KB

      • memory/1948-63-0x0000000000A30000-0x0000000000A62000-memory.dmp
        Filesize

        200KB

      • memory/1948-56-0x0000000000420000-0x000000000043C000-memory.dmp
        Filesize

        112KB

      • memory/1948-55-0x00000000754A1000-0x00000000754A3000-memory.dmp
        Filesize

        8KB