Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 18:54
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
632KB
-
MD5
cb38d8143b2216edab036acee36f25b4
-
SHA1
1401d9123df44612f599865e9b2df8941779c687
-
SHA256
7fd0e394a9d74592a74d04b3dccf2dcf8457d0e894cadadbf999c327e9b3940e
-
SHA512
15315313dc0cc805771c7a3ccdf20851e39279a001272cdf71e1078fd7b907d83ffa6fc6292e83743963849ea1b2433036e746c8377edf8f6c9dcb2f76e2f010
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2020-64-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/2020-65-0x00000000004201D0-mapping.dmp xloader behavioral1/memory/2020-67-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1036-73-0x0000000000080000-0x00000000000AC000-memory.dmp xloader behavioral1/memory/1036-78-0x0000000000080000-0x00000000000AC000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation tmp.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 572 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
chkdsk.exepid process 1036 chkdsk.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chkdsk.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AZTPZLIX = "C:\\Program Files (x86)\\Jzv1h8\\mfc1bgxnno.exe" chkdsk.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.exechkdsk.exedescription pid process target process PID 384 set thread context of 2020 384 tmp.exe tmp.exe PID 2020 set thread context of 1236 2020 tmp.exe Explorer.EXE PID 1036 set thread context of 1236 1036 chkdsk.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
chkdsk.exedescription ioc process File opened for modification C:\Program Files (x86)\Jzv1h8\mfc1bgxnno.exe chkdsk.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
tmp.exetmp.exechkdsk.exepid process 384 tmp.exe 2020 tmp.exe 2020 tmp.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
tmp.exechkdsk.exepid process 2020 tmp.exe 2020 tmp.exe 2020 tmp.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe 1036 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.exetmp.exechkdsk.exedescription pid process Token: SeDebugPrivilege 384 tmp.exe Token: SeDebugPrivilege 2020 tmp.exe Token: SeDebugPrivilege 1036 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
tmp.exeExplorer.EXEchkdsk.exedescription pid process target process PID 384 wrote to memory of 1996 384 tmp.exe tmp.exe PID 384 wrote to memory of 1996 384 tmp.exe tmp.exe PID 384 wrote to memory of 1996 384 tmp.exe tmp.exe PID 384 wrote to memory of 1996 384 tmp.exe tmp.exe PID 384 wrote to memory of 2020 384 tmp.exe tmp.exe PID 384 wrote to memory of 2020 384 tmp.exe tmp.exe PID 384 wrote to memory of 2020 384 tmp.exe tmp.exe PID 384 wrote to memory of 2020 384 tmp.exe tmp.exe PID 384 wrote to memory of 2020 384 tmp.exe tmp.exe PID 384 wrote to memory of 2020 384 tmp.exe tmp.exe PID 384 wrote to memory of 2020 384 tmp.exe tmp.exe PID 1236 wrote to memory of 1036 1236 Explorer.EXE chkdsk.exe PID 1236 wrote to memory of 1036 1236 Explorer.EXE chkdsk.exe PID 1236 wrote to memory of 1036 1236 Explorer.EXE chkdsk.exe PID 1236 wrote to memory of 1036 1236 Explorer.EXE chkdsk.exe PID 1036 wrote to memory of 572 1036 chkdsk.exe cmd.exe PID 1036 wrote to memory of 572 1036 chkdsk.exe cmd.exe PID 1036 wrote to memory of 572 1036 chkdsk.exe cmd.exe PID 1036 wrote to memory of 572 1036 chkdsk.exe cmd.exe PID 1036 wrote to memory of 668 1036 chkdsk.exe Firefox.exe PID 1036 wrote to memory of 668 1036 chkdsk.exe Firefox.exe PID 1036 wrote to memory of 668 1036 chkdsk.exe Firefox.exe PID 1036 wrote to memory of 668 1036 chkdsk.exe Firefox.exe PID 1036 wrote to memory of 668 1036 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
628KB
MD5e3b107beaf9eaab93d09738d7dcb0946
SHA1e625eac28fad8d1ed8544a35b9e54e596313b266
SHA2568dccdffda1babc90e9917e7927c7387e4ca8e556f0bb94aace207c998a289223
SHA512c08038d6c7c527ae1e13540358c2a117e5aa6275643b2d88e19e1dc7dd0aa4191c74598e385c57d854866c2de31688fb3640bc7e3a2303b8291154375398305a
-
memory/384-54-0x0000000000C20000-0x0000000000CC4000-memory.dmpFilesize
656KB
-
memory/384-55-0x00000000763E1000-0x00000000763E3000-memory.dmpFilesize
8KB
-
memory/384-56-0x0000000002260000-0x00000000022E4000-memory.dmpFilesize
528KB
-
memory/384-57-0x0000000000290000-0x00000000002B0000-memory.dmpFilesize
128KB
-
memory/384-58-0x00000000004D0000-0x00000000004DE000-memory.dmpFilesize
56KB
-
memory/384-59-0x0000000007E70000-0x0000000007EE6000-memory.dmpFilesize
472KB
-
memory/384-60-0x0000000000BC0000-0x0000000000BF2000-memory.dmpFilesize
200KB
-
memory/572-74-0x0000000000000000-mapping.dmp
-
memory/1036-75-0x0000000001F00000-0x0000000002203000-memory.dmpFilesize
3.0MB
-
memory/1036-76-0x0000000001DF0000-0x0000000001E80000-memory.dmpFilesize
576KB
-
memory/1036-78-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/1036-71-0x0000000000000000-mapping.dmp
-
memory/1036-72-0x00000000002F0000-0x00000000002F7000-memory.dmpFilesize
28KB
-
memory/1036-73-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/1236-79-0x0000000006A70000-0x0000000006BB9000-memory.dmpFilesize
1.3MB
-
memory/1236-77-0x0000000006A70000-0x0000000006BB9000-memory.dmpFilesize
1.3MB
-
memory/1236-70-0x0000000004AC0000-0x0000000004C3B000-memory.dmpFilesize
1.5MB
-
memory/2020-69-0x0000000000140000-0x0000000000151000-memory.dmpFilesize
68KB
-
memory/2020-62-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2020-64-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2020-65-0x00000000004201D0-mapping.dmp
-
memory/2020-68-0x0000000000CD0000-0x0000000000FD3000-memory.dmpFilesize
3.0MB
-
memory/2020-67-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2020-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB