Overview

overview

10

Static

static

SecuriteIn...81.exe

windows7_x64

3

SecuriteIn...81.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    01/07/2022, 09:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Variant.Tedy.144323.23481.exe
  • Size 645KB
  • Sample220701-lmqctadhf2
  • SHA256 dfa23e54ff284a6a1c73a0371bfb49f94a9f8885b951f96f9a6ab6dbdbe9d489
  • MD5 SHA1 SHA512
Score
10/10
formbookxloaderhfhfloaderpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • hfhf

Decoy

  • richardjfreeman.com

  • malapeca.cat

  • fattygay.com

  • queroleads.com

  • kisfor.xyz

  • metodoenriquecimento.net

  • santaclausbook.com

  • erinnandmike.com

  • fscehd.com

  • aroundthesoundrealty.com

  • racevideoindex.com

  • mediafacing.com

  • solarnurd.com

  • bhulbhulaiya.com

  • jybv.website

  • akquaa.com

  • visionbeyondthelight.com

  • bunerden.net

  • xupersports.info

  • gititngit.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata
  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata
  • Xloader Payload 4 IoCs
    rat
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.144323.23481.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.144323.23481.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\SysWOW64\tttracer.exe
        "C:\Windows\SysWOW64\tttracer.exe"
        3⤵
          PID:4388
        • C:\Windows\SysWOW64\systeminfo.exe
          "C:\Windows\SysWOW64\systeminfo.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Gathers system information
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1872
      • C:\Windows\SysWOW64\WWAHost.exe
        "C:\Windows\SysWOW64\WWAHost.exe"
        2⤵
        • Adds policy Run key to start application
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1384
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\SysWOW64\systeminfo.exe"
          3⤵
            PID:1064
          • C:\Windows\SysWOW64\cmd.exe
            /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
            3⤵
              PID:3020
            • C:\Windows\SysWOW64\cmd.exe
              /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
              3⤵
                PID:4256
              • C:\Program Files\Mozilla Firefox\Firefox.exe
                "C:\Program Files\Mozilla Firefox\Firefox.exe"
                3⤵
                  PID:4984
              • C:\Program Files (x86)\Iyn8\on2tzh.exe
                "C:\Program Files (x86)\Iyn8\on2tzh.exe"
                2⤵
                • Executes dropped EXE
                PID:1160

            Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  on2tzh.exe
                  • Path C:\Program Files (x86)\Iyn8\on2tzh.exe
                  • Size 75KB
                  • SHA256 f1e43f167059ff746e200b21ddc55326cd8b3acd7d6bd9c541230db6f8bc63d1
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  on2tzh.exe
                  • Path C:\Program Files (x86)\Iyn8\on2tzh.exe
                  • Size 75KB
                  • SHA256 f1e43f167059ff746e200b21ddc55326cd8b3acd7d6bd9c541230db6f8bc63d1
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  DB1
                  • Path C:\Users\Admin\AppData\Local\Temp\DB1
                  • Size 40KB
                  • SHA256 b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  DB1
                  • Path C:\Users\Admin\AppData\Local\Temp\DB1
                  • Size 48KB
                  • SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  memory/1384-143-0x0000000000D50000-0x0000000000D7B000-memory.dmp
                  Download

                  memory/1384-142-0x00000000007A0000-0x000000000087C000-memory.dmp
                  Download

                  memory/1384-144-0x0000000001FF0000-0x000000000233A000-memory.dmp
                  Download

                  memory/1384-145-0x0000000001D10000-0x0000000001DA0000-memory.dmp
                  Download

                  memory/1384-147-0x0000000000D50000-0x0000000000D7B000-memory.dmp
                  Download

                  memory/1872-136-0x0000000000F80000-0x00000000012CA000-memory.dmp
                  Download

                  memory/1872-140-0x0000000000400000-0x000000000042C000-memory.dmp
                  Download

                  memory/1872-137-0x0000000000BE0000-0x0000000000BF1000-memory.dmp
                  Download

                  memory/1872-134-0x0000000000400000-0x000000000042C000-memory.dmp
                  Download

                  memory/2240-146-0x0000000008870000-0x0000000008935000-memory.dmp
                  Download

                  memory/2240-150-0x0000000008870000-0x0000000008935000-memory.dmp
                  Download

                  memory/2240-138-0x00000000081E0000-0x0000000008318000-memory.dmp
                  Download

                  memory/4776-130-0x00000000002B0000-0x0000000000358000-memory.dmp
                  Download

                  memory/4776-131-0x0000000004C80000-0x0000000004D1C000-memory.dmp
                  Download