Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05-07-2022 09:08

General

  • Target

    kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe

  • Size

    382KB

  • MD5

    69c60f14117c4a3440b945c28dcff034

  • SHA1

    1891b961eb682ba5fbe8e2be9bb0a5c748c73cfc

  • SHA256

    89ce5deea4986b1d484b34bee77c58899dab5ce01c8f62b9ac2ca8e9bbed79bd

  • SHA512

    0b8f798757f1ab70430db150d6c2251484f25c7bed52bab32ddcc12adb2a41930c420e4eda194dd980af99012c9315b085eb5eb24d04f3059f2259241eaa9ee0

Malware Config

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

  • Xloader Payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3136
    • C:\Users\Admin\AppData\Local\Temp\kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe
      "C:\Users\Admin\AppData\Local\Temp\kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4420
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:4400
      • C:\Windows\SysWOW64\autochk.exe
        "C:\Windows\SysWOW64\autochk.exe"
        2⤵
          PID:3568
        • C:\Windows\SysWOW64\autochk.exe
          "C:\Windows\SysWOW64\autochk.exe"
          2⤵
            PID:3612
          • C:\Windows\SysWOW64\autochk.exe
            "C:\Windows\SysWOW64\autochk.exe"
            2⤵
              PID:4588
            • C:\Windows\SysWOW64\msiexec.exe
              "C:\Windows\SysWOW64\msiexec.exe"
              2⤵
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • Drops file in Program Files directory
              • Modifies Internet Explorer settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2368
              • C:\Windows\SysWOW64\cmd.exe
                /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
                3⤵
                  PID:4872
                • C:\Program Files\Mozilla Firefox\Firefox.exe
                  "C:\Program Files\Mozilla Firefox\Firefox.exe"
                  3⤵
                    PID:4832
                • C:\Program Files (x86)\D5ji4w\s0sdana8apxxm.exe
                  "C:\Program Files (x86)\D5ji4w\s0sdana8apxxm.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:1004

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              Registry Run Keys / Startup Folder

              1
              T1060

              Defense Evasion

              Modify Registry

              2
              T1112

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\D5ji4w\s0sdana8apxxm.exe
                Filesize

                45KB

                MD5

                70d838a7dc5b359c3f938a71fad77db0

                SHA1

                66b83eb16481c334719eed406bc58a3c2b910923

                SHA256

                e4dbdbf7888ea96f3f8aa5c4c7f2bcf6e57d724dd8194fe5f35b673c6ef724ea

                SHA512

                9c9a945db5b5e7ff8105bfe74578e6f00b5f707f7c3d8f1f1fb41553a6d0eab29cef026e77877a1ad6435fa7bc369141921442e1485f2b0894c6bbcbd7791034

              • C:\Program Files (x86)\D5ji4w\s0sdana8apxxm.exe
                Filesize

                45KB

                MD5

                70d838a7dc5b359c3f938a71fad77db0

                SHA1

                66b83eb16481c334719eed406bc58a3c2b910923

                SHA256

                e4dbdbf7888ea96f3f8aa5c4c7f2bcf6e57d724dd8194fe5f35b673c6ef724ea

                SHA512

                9c9a945db5b5e7ff8105bfe74578e6f00b5f707f7c3d8f1f1fb41553a6d0eab29cef026e77877a1ad6435fa7bc369141921442e1485f2b0894c6bbcbd7791034

              • memory/1004-147-0x0000000000000000-mapping.dmp
              • memory/1524-130-0x0000000000800000-0x0000000000862000-memory.dmp
                Filesize

                392KB

              • memory/2368-137-0x0000000000000000-mapping.dmp
              • memory/2368-145-0x0000000000810000-0x000000000083C000-memory.dmp
                Filesize

                176KB

              • memory/2368-141-0x0000000000810000-0x000000000083C000-memory.dmp
                Filesize

                176KB

              • memory/2368-140-0x0000000000490000-0x00000000004A2000-memory.dmp
                Filesize

                72KB

              • memory/2368-142-0x0000000002710000-0x0000000002A5A000-memory.dmp
                Filesize

                3.3MB

              • memory/2368-143-0x0000000002540000-0x00000000025D0000-memory.dmp
                Filesize

                576KB

              • memory/3136-136-0x0000000008660000-0x0000000008768000-memory.dmp
                Filesize

                1.0MB

              • memory/3136-144-0x0000000008A40000-0x0000000008B7D000-memory.dmp
                Filesize

                1.2MB

              • memory/3136-146-0x0000000008A40000-0x0000000008B7D000-memory.dmp
                Filesize

                1.2MB

              • memory/4420-135-0x0000000001520000-0x0000000001531000-memory.dmp
                Filesize

                68KB

              • memory/4420-138-0x0000000000400000-0x000000000042C000-memory.dmp
                Filesize

                176KB

              • memory/4420-134-0x00000000019E0000-0x0000000001D2A000-memory.dmp
                Filesize

                3.3MB

              • memory/4420-132-0x0000000000400000-0x000000000042C000-memory.dmp
                Filesize

                176KB

              • memory/4420-131-0x0000000000000000-mapping.dmp
              • memory/4872-139-0x0000000000000000-mapping.dmp