Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 08:18
Static task
static1
Behavioral task
behavioral1
Sample
New order 07,06,2022.exe
Resource
win7-20220414-en
General
-
Target
New order 07,06,2022.exe
-
Size
626KB
-
MD5
1287d9ae257300407cf7490872764eab
-
SHA1
b71bc21b67a5b1031ed873b02e54726394c90060
-
SHA256
f6db3a2b3160b40742b164c6bbe0496368f4fc52d1a16757a49d023f5189b428
-
SHA512
4ebd21f597a8c5025216aa44df4d44afeaadb16729cf049b95a329ebd0d47def09c5fbd9f518dd0560101ffe5c30405f6ecf13e9502841bfcf8c52332ee8d13e
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/108-63-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/108-64-0x000000000041FFD0-mapping.dmp xloader behavioral1/memory/108-66-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/2004-72-0x0000000000090000-0x00000000000BC000-memory.dmp xloader behavioral1/memory/2004-77-0x0000000000090000-0x00000000000BC000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
wuapp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JHL0HZEHUBJ = "C:\\Program Files (x86)\\Xpbfpjl\\mfczv1llp.exe" wuapp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wuapp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
New order 07,06,2022.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\International\Geo\Nation New order 07,06,2022.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1956 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
wuapp.exepid process 2004 wuapp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
New order 07,06,2022.exeNew order 07,06,2022.exewuapp.exedescription pid process target process PID 1856 set thread context of 108 1856 New order 07,06,2022.exe New order 07,06,2022.exe PID 108 set thread context of 1248 108 New order 07,06,2022.exe Explorer.EXE PID 2004 set thread context of 1248 2004 wuapp.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
wuapp.exedescription ioc process File opened for modification C:\Program Files (x86)\Xpbfpjl\mfczv1llp.exe wuapp.exe -
Processes:
wuapp.exedescription ioc process Key created \Registry\User\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wuapp.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
New order 07,06,2022.exewuapp.exepid process 108 New order 07,06,2022.exe 108 New order 07,06,2022.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
New order 07,06,2022.exewuapp.exepid process 108 New order 07,06,2022.exe 108 New order 07,06,2022.exe 108 New order 07,06,2022.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe 2004 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New order 07,06,2022.exewuapp.exedescription pid process Token: SeDebugPrivilege 108 New order 07,06,2022.exe Token: SeDebugPrivilege 2004 wuapp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
New order 07,06,2022.exeExplorer.EXEwuapp.exedescription pid process target process PID 1856 wrote to memory of 108 1856 New order 07,06,2022.exe New order 07,06,2022.exe PID 1856 wrote to memory of 108 1856 New order 07,06,2022.exe New order 07,06,2022.exe PID 1856 wrote to memory of 108 1856 New order 07,06,2022.exe New order 07,06,2022.exe PID 1856 wrote to memory of 108 1856 New order 07,06,2022.exe New order 07,06,2022.exe PID 1856 wrote to memory of 108 1856 New order 07,06,2022.exe New order 07,06,2022.exe PID 1856 wrote to memory of 108 1856 New order 07,06,2022.exe New order 07,06,2022.exe PID 1856 wrote to memory of 108 1856 New order 07,06,2022.exe New order 07,06,2022.exe PID 1248 wrote to memory of 2004 1248 Explorer.EXE wuapp.exe PID 1248 wrote to memory of 2004 1248 Explorer.EXE wuapp.exe PID 1248 wrote to memory of 2004 1248 Explorer.EXE wuapp.exe PID 1248 wrote to memory of 2004 1248 Explorer.EXE wuapp.exe PID 1248 wrote to memory of 2004 1248 Explorer.EXE wuapp.exe PID 1248 wrote to memory of 2004 1248 Explorer.EXE wuapp.exe PID 1248 wrote to memory of 2004 1248 Explorer.EXE wuapp.exe PID 2004 wrote to memory of 1956 2004 wuapp.exe cmd.exe PID 2004 wrote to memory of 1956 2004 wuapp.exe cmd.exe PID 2004 wrote to memory of 1956 2004 wuapp.exe cmd.exe PID 2004 wrote to memory of 1956 2004 wuapp.exe cmd.exe PID 2004 wrote to memory of 1240 2004 wuapp.exe Firefox.exe PID 2004 wrote to memory of 1240 2004 wuapp.exe Firefox.exe PID 2004 wrote to memory of 1240 2004 wuapp.exe Firefox.exe PID 2004 wrote to memory of 1240 2004 wuapp.exe Firefox.exe PID 2004 wrote to memory of 1240 2004 wuapp.exe Firefox.exe PID 2004 wrote to memory of 1420 2004 wuapp.exe cmd.exe PID 2004 wrote to memory of 1420 2004 wuapp.exe cmd.exe PID 2004 wrote to memory of 1420 2004 wuapp.exe cmd.exe PID 2004 wrote to memory of 1420 2004 wuapp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New order 07,06,2022.exe"C:\Users\Admin\AppData\Local\Temp\New order 07,06,2022.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New order 07,06,2022.exe"C:\Users\Admin\AppData\Local\Temp\New order 07,06,2022.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\New order 07,06,2022.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
650KB
MD55c73e64374d9ba37ac5569d1f7de5c9b
SHA1592e26ffea429b30e0a648720b43739d2ff5e590
SHA2565d0a5018218dbc363909a7eb915a763863cfbcad6d1a6231eb20633d098d57c7
SHA512c0cfaf1bd497a799b3480a268bc4d2548d139f3f4b9f1ed41b09cd4c934d285b0ca36c1c3f45f8718feb50274bce1897939d0dfe612e26010c8bbaf004fe8905
-
memory/108-68-0x0000000000170000-0x0000000000181000-memory.dmpFilesize
68KB
-
memory/108-60-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/108-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/108-63-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/108-64-0x000000000041FFD0-mapping.dmp
-
memory/108-66-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/108-67-0x0000000000BE0000-0x0000000000EE3000-memory.dmpFilesize
3.0MB
-
memory/1248-76-0x0000000006C70000-0x0000000006DD1000-memory.dmpFilesize
1.4MB
-
memory/1248-69-0x0000000005D30000-0x0000000005E48000-memory.dmpFilesize
1.1MB
-
memory/1248-79-0x0000000006C70000-0x0000000006DD1000-memory.dmpFilesize
1.4MB
-
memory/1420-81-0x0000000000000000-mapping.dmp
-
memory/1856-56-0x00000000004B0000-0x00000000004D0000-memory.dmpFilesize
128KB
-
memory/1856-57-0x0000000000290000-0x000000000029E000-memory.dmpFilesize
56KB
-
memory/1856-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB
-
memory/1856-59-0x0000000000920000-0x0000000000952000-memory.dmpFilesize
200KB
-
memory/1856-58-0x0000000004F20000-0x0000000004F9A000-memory.dmpFilesize
488KB
-
memory/1856-54-0x00000000009A0000-0x0000000000A44000-memory.dmpFilesize
656KB
-
memory/1956-73-0x0000000000000000-mapping.dmp
-
memory/2004-72-0x0000000000090000-0x00000000000BC000-memory.dmpFilesize
176KB
-
memory/2004-71-0x0000000000B10000-0x0000000000B1B000-memory.dmpFilesize
44KB
-
memory/2004-70-0x0000000000000000-mapping.dmp
-
memory/2004-74-0x00000000020B0000-0x00000000023B3000-memory.dmpFilesize
3.0MB
-
memory/2004-75-0x0000000000960000-0x00000000009F0000-memory.dmpFilesize
576KB
-
memory/2004-77-0x0000000000090000-0x00000000000BC000-memory.dmpFilesize
176KB