Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 18:54
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
tmp.exe
-
Size
632KB
-
MD5
cb38d8143b2216edab036acee36f25b4
-
SHA1
1401d9123df44612f599865e9b2df8941779c687
-
SHA256
7fd0e394a9d74592a74d04b3dccf2dcf8457d0e894cadadbf999c327e9b3940e
-
SHA512
15315313dc0cc805771c7a3ccdf20851e39279a001272cdf71e1078fd7b907d83ffa6fc6292e83743963849ea1b2433036e746c8377edf8f6c9dcb2f76e2f010
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4412-137-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/4412-143-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/2264-146-0x0000000000C50000-0x0000000000C7C000-memory.dmp xloader behavioral2/memory/2264-150-0x0000000000C50000-0x0000000000C7C000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation tmp.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
colorcpl.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GNQLS6HX4X = "C:\\Program Files (x86)\\Fshwp\\igfxzh88.exe" colorcpl.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.execolorcpl.exedescription pid process target process PID 1640 set thread context of 4412 1640 tmp.exe tmp.exe PID 4412 set thread context of 3064 4412 tmp.exe Explorer.EXE PID 2264 set thread context of 3064 2264 colorcpl.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
colorcpl.exedescription ioc process File opened for modification C:\Program Files (x86)\Fshwp\igfxzh88.exe colorcpl.exe -
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
tmp.execolorcpl.exepid process 4412 tmp.exe 4412 tmp.exe 4412 tmp.exe 4412 tmp.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3064 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
tmp.execolorcpl.exepid process 4412 tmp.exe 4412 tmp.exe 4412 tmp.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe 2264 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.execolorcpl.exedescription pid process Token: SeDebugPrivilege 4412 tmp.exe Token: SeDebugPrivilege 2264 colorcpl.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1640 wrote to memory of 4412 1640 tmp.exe tmp.exe PID 1640 wrote to memory of 4412 1640 tmp.exe tmp.exe PID 1640 wrote to memory of 4412 1640 tmp.exe tmp.exe PID 1640 wrote to memory of 4412 1640 tmp.exe tmp.exe PID 1640 wrote to memory of 4412 1640 tmp.exe tmp.exe PID 1640 wrote to memory of 4412 1640 tmp.exe tmp.exe PID 3064 wrote to memory of 2264 3064 Explorer.EXE colorcpl.exe PID 3064 wrote to memory of 2264 3064 Explorer.EXE colorcpl.exe PID 3064 wrote to memory of 2264 3064 Explorer.EXE colorcpl.exe PID 2264 wrote to memory of 4916 2264 colorcpl.exe cmd.exe PID 2264 wrote to memory of 4916 2264 colorcpl.exe cmd.exe PID 2264 wrote to memory of 4916 2264 colorcpl.exe cmd.exe PID 2264 wrote to memory of 1956 2264 colorcpl.exe Firefox.exe PID 2264 wrote to memory of 1956 2264 colorcpl.exe Firefox.exe PID 2264 wrote to memory of 1956 2264 colorcpl.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1640-130-0x0000000000E50000-0x0000000000EF4000-memory.dmpFilesize
656KB
-
memory/1640-131-0x0000000005F40000-0x00000000064E4000-memory.dmpFilesize
5.6MB
-
memory/1640-132-0x00000000058A0000-0x0000000005932000-memory.dmpFilesize
584KB
-
memory/1640-133-0x0000000005940000-0x000000000594A000-memory.dmpFilesize
40KB
-
memory/1640-134-0x0000000009960000-0x00000000099FC000-memory.dmpFilesize
624KB
-
memory/1640-135-0x0000000009A70000-0x0000000009AD6000-memory.dmpFilesize
408KB
-
memory/2264-147-0x0000000002B90000-0x0000000002EDA000-memory.dmpFilesize
3.3MB
-
memory/2264-145-0x0000000000210000-0x0000000000229000-memory.dmpFilesize
100KB
-
memory/2264-150-0x0000000000C50000-0x0000000000C7C000-memory.dmpFilesize
176KB
-
memory/2264-148-0x0000000002A20000-0x0000000002AB0000-memory.dmpFilesize
576KB
-
memory/2264-146-0x0000000000C50000-0x0000000000C7C000-memory.dmpFilesize
176KB
-
memory/2264-142-0x0000000000000000-mapping.dmp
-
memory/3064-141-0x00000000082B0000-0x000000000844F000-memory.dmpFilesize
1.6MB
-
memory/3064-149-0x0000000003400000-0x00000000034A3000-memory.dmpFilesize
652KB
-
memory/3064-151-0x0000000003400000-0x00000000034A3000-memory.dmpFilesize
652KB
-
memory/4412-143-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4412-136-0x0000000000000000-mapping.dmp
-
memory/4412-137-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4412-140-0x0000000001460000-0x0000000001471000-memory.dmpFilesize
68KB
-
memory/4412-138-0x0000000000F50000-0x000000000129A000-memory.dmpFilesize
3.3MB
-
memory/4916-144-0x0000000000000000-mapping.dmp