Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    30-06-2022 13:41

General

  • Target

    SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe

  • Size

    924KB

  • MD5

    4e13d4aa0427eb41203deb4d021ec71c

  • SHA1

    12762fa4762e1c1a16cc31656e7a80b7a2428fb5

  • SHA256

    d25d2c22b3843c1e8aaecec11b29d4ebb6fbe5b67a6f5a345abf0709516920d3

  • SHA512

    4555a7e0dee519f47e92abc7360cb2a48809ccc3cefd12c0146a58f9a8154e9da7f386b002e5e19fede969ded728c06f186331f75d0c415353daab724bed1510

Malware Config

Extracted

Family

xloader

Version

2.7

Campaign

n5mz

Decoy

ezhuilike.com

broomstickrum.com

ramaniclothing.com

midbots.com

rlxscpe.com

elanagro.online

chahuajie.com

digipubcity.com

predatorstoppers.com

savas-jewelry.com

timinis23.com

homesteaddesignstudio.net

bellezadehoy.online

disintar.xyz

sharinks.tech

redfoxdetroit.com

resscoptheron.com

aspiritualgiftshoppe.com

tematemazo.com

assasa.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

  • ModiLoader Second Stage 38 IoCs
  • Xloader Payload 6 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanDownloader.Delf.DIB.21975.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\SysWOW64\DpiScaling.exe
        C:\Windows\System32\DpiScaling.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2124
    • C:\Windows\SysWOW64\WWAHost.exe
      "C:\Windows\SysWOW64\WWAHost.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4536
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\DpiScaling.exe"
        3⤵
          PID:3928
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:1076
          • C:\Windows\SysWOW64\cmd.exe
            /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
            3⤵
              PID:2484
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:1280
            • C:\Program Files (x86)\Rrnyleflh\o6qlwjmxnnh.exe
              "C:\Program Files (x86)\Rrnyleflh\o6qlwjmxnnh.exe"
              2⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:1068
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe" ms-settings:display
                3⤵
                  PID:1792
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
                PID:764
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
                1⤵
                  PID:2336

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                Registry Run Keys / Startup Folder

                1
                T1060

                Defense Evasion

                Modify Registry

                2
                T1112

                Credential Access

                Credentials in Files

                1
                T1081

                Discovery

                Query Registry

                1
                T1012

                System Information Discovery

                2
                T1082

                Collection

                Data from Local System

                1
                T1005

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\Rrnyleflh\o6qlwjmxnnh.exe
                  Filesize

                  75KB

                  MD5

                  d44d3a0f5e53f6ecc5c6232930cfcc5e

                  SHA1

                  d42b4fc663fb0328a2307ec7c8f56f220872d953

                  SHA256

                  fa1dd224289d1c39c49cb5dd2896fa19a3091ce650d6b665626d5d30b65dee9e

                  SHA512

                  a4104e8abb58d17d6565a410a5e4653280827d2291bfedb59201e368dce475b43b79fdd3087dce46c8e0a95cad78afb15e0c1fb351babd7168e39e26ef861af6

                • C:\Program Files (x86)\Rrnyleflh\o6qlwjmxnnh.exe
                  Filesize

                  75KB

                  MD5

                  d44d3a0f5e53f6ecc5c6232930cfcc5e

                  SHA1

                  d42b4fc663fb0328a2307ec7c8f56f220872d953

                  SHA256

                  fa1dd224289d1c39c49cb5dd2896fa19a3091ce650d6b665626d5d30b65dee9e

                  SHA512

                  a4104e8abb58d17d6565a410a5e4653280827d2291bfedb59201e368dce475b43b79fdd3087dce46c8e0a95cad78afb15e0c1fb351babd7168e39e26ef861af6

                • C:\Users\Admin\AppData\Local\Temp\DB1
                  Filesize

                  40KB

                  MD5

                  b608d407fc15adea97c26936bc6f03f6

                  SHA1

                  953e7420801c76393902c0d6bb56148947e41571

                  SHA256

                  b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                  SHA512

                  cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

                • C:\Users\Admin\AppData\Local\Temp\DB1
                  Filesize

                  48KB

                  MD5

                  349e6eb110e34a08924d92f6b334801d

                  SHA1

                  bdfb289daff51890cc71697b6322aa4b35ec9169

                  SHA256

                  c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                  SHA512

                  2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                • memory/1060-195-0x0000000002A10000-0x0000000002AC4000-memory.dmp
                  Filesize

                  720KB

                • memory/1060-203-0x0000000007250000-0x0000000007317000-memory.dmp
                  Filesize

                  796KB

                • memory/1060-205-0x0000000007250000-0x0000000007317000-memory.dmp
                  Filesize

                  796KB

                • memory/1060-192-0x0000000007C60000-0x0000000007D9E000-memory.dmp
                  Filesize

                  1.2MB

                • memory/1068-210-0x0000000000000000-mapping.dmp
                • memory/1076-206-0x0000000000000000-mapping.dmp
                • memory/1792-213-0x0000000000000000-mapping.dmp
                • memory/2124-191-0x00000000021B0000-0x00000000021C1000-memory.dmp
                  Filesize

                  68KB

                • memory/2124-190-0x0000000002400000-0x000000000274A000-memory.dmp
                  Filesize

                  3.3MB

                • memory/2124-189-0x0000000010410000-0x000000001043B000-memory.dmp
                  Filesize

                  172KB

                • memory/2124-197-0x0000000010410000-0x000000001043B000-memory.dmp
                  Filesize

                  172KB

                • memory/2124-168-0x0000000000000000-mapping.dmp
                • memory/2124-194-0x00000000021F0000-0x0000000002201000-memory.dmp
                  Filesize

                  68KB

                • memory/2484-208-0x0000000000000000-mapping.dmp
                • memory/2704-169-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-152-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-156-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-158-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-159-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-157-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-160-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-161-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-162-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-163-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-164-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-165-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-167-0x0000000010410000-0x000000001043B000-memory.dmp
                  Filesize

                  172KB

                • memory/2704-170-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-154-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-171-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-173-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-172-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-181-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-180-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-183-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-182-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-153-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-155-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-184-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-185-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-187-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-186-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-141-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-151-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-142-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-143-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-145-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-144-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-146-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-150-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-147-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-149-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/2704-148-0x0000000002980000-0x00000000029D2000-memory.dmp
                  Filesize

                  328KB

                • memory/3928-200-0x0000000000000000-mapping.dmp
                • memory/4536-204-0x0000000000B90000-0x0000000000BBB000-memory.dmp
                  Filesize

                  172KB

                • memory/4536-202-0x0000000001B20000-0x0000000001BB0000-memory.dmp
                  Filesize

                  576KB

                • memory/4536-201-0x0000000001CF0000-0x000000000203A000-memory.dmp
                  Filesize

                  3.3MB

                • memory/4536-199-0x0000000000B90000-0x0000000000BBB000-memory.dmp
                  Filesize

                  172KB

                • memory/4536-198-0x0000000000320000-0x00000000003FC000-memory.dmp
                  Filesize

                  880KB

                • memory/4536-196-0x0000000000000000-mapping.dmp