Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 18:38
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
tmp.exe
-
Size
635KB
-
MD5
2648e55802ea0888fea42a50ff7443a9
-
SHA1
1de56299bfca5e0417263ba8954a925f6d5cf8fb
-
SHA256
a9aa59bed8eb3e4839b215c072549c359c3867b238e65c4bf98a5f274d2808bb
-
SHA512
ecbcfd564144f225250309786f1e828383e8e524c75b548990b6aa739e8cf794ac7d076fa93e8da3abc512ec747092623cc44676de25fb373163754750b8a08f
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1708-65-0x0000000000420280-mapping.dmp xloader behavioral1/memory/1708-64-0x0000000000400000-0x000000000042D000-memory.dmp xloader behavioral1/memory/1708-67-0x0000000000400000-0x000000000042D000-memory.dmp xloader behavioral1/memory/2020-74-0x0000000000080000-0x00000000000AD000-memory.dmp xloader behavioral1/memory/2020-78-0x0000000000080000-0x00000000000AD000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation tmp.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1652 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.exesystray.exedescription pid process target process PID 1052 set thread context of 1708 1052 tmp.exe tmp.exe PID 1708 set thread context of 1212 1708 tmp.exe Explorer.EXE PID 2020 set thread context of 1212 2020 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
tmp.exesystray.exepid process 1708 tmp.exe 1708 tmp.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe 2020 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tmp.exesystray.exepid process 1708 tmp.exe 1708 tmp.exe 1708 tmp.exe 2020 systray.exe 2020 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exesystray.exedescription pid process Token: SeDebugPrivilege 1708 tmp.exe Token: SeDebugPrivilege 2020 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.exeExplorer.EXEsystray.exedescription pid process target process PID 1052 wrote to memory of 1708 1052 tmp.exe tmp.exe PID 1052 wrote to memory of 1708 1052 tmp.exe tmp.exe PID 1052 wrote to memory of 1708 1052 tmp.exe tmp.exe PID 1052 wrote to memory of 1708 1052 tmp.exe tmp.exe PID 1052 wrote to memory of 1708 1052 tmp.exe tmp.exe PID 1052 wrote to memory of 1708 1052 tmp.exe tmp.exe PID 1052 wrote to memory of 1708 1052 tmp.exe tmp.exe PID 1212 wrote to memory of 2020 1212 Explorer.EXE systray.exe PID 1212 wrote to memory of 2020 1212 Explorer.EXE systray.exe PID 1212 wrote to memory of 2020 1212 Explorer.EXE systray.exe PID 1212 wrote to memory of 2020 1212 Explorer.EXE systray.exe PID 2020 wrote to memory of 1652 2020 systray.exe cmd.exe PID 2020 wrote to memory of 1652 2020 systray.exe cmd.exe PID 2020 wrote to memory of 1652 2020 systray.exe cmd.exe PID 2020 wrote to memory of 1652 2020 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1052-54-0x0000000000D50000-0x0000000000DF4000-memory.dmpFilesize
656KB
-
memory/1052-55-0x0000000076C81000-0x0000000076C83000-memory.dmpFilesize
8KB
-
memory/1052-56-0x00000000022D0000-0x0000000002354000-memory.dmpFilesize
528KB
-
memory/1052-57-0x0000000000500000-0x0000000000520000-memory.dmpFilesize
128KB
-
memory/1052-58-0x0000000000630000-0x000000000063E000-memory.dmpFilesize
56KB
-
memory/1052-59-0x00000000046E0000-0x0000000004756000-memory.dmpFilesize
472KB
-
memory/1052-60-0x0000000000950000-0x0000000000982000-memory.dmpFilesize
200KB
-
memory/1212-79-0x0000000006020000-0x00000000060FA000-memory.dmpFilesize
872KB
-
memory/1212-77-0x0000000006020000-0x00000000060FA000-memory.dmpFilesize
872KB
-
memory/1212-70-0x0000000005F20000-0x0000000006014000-memory.dmpFilesize
976KB
-
memory/1652-72-0x0000000000000000-mapping.dmp
-
memory/1708-68-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/1708-67-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1708-69-0x0000000000200000-0x0000000000211000-memory.dmpFilesize
68KB
-
memory/1708-64-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1708-65-0x0000000000420280-mapping.dmp
-
memory/1708-62-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1708-61-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2020-71-0x0000000000000000-mapping.dmp
-
memory/2020-73-0x0000000000810000-0x0000000000815000-memory.dmpFilesize
20KB
-
memory/2020-75-0x0000000002080000-0x0000000002383000-memory.dmpFilesize
3.0MB
-
memory/2020-74-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/2020-76-0x0000000001E40000-0x0000000001ED0000-memory.dmpFilesize
576KB
-
memory/2020-78-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB