Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 07:53
Static task
static1
Behavioral task
behavioral1
Sample
Invoice B9800177.exe
Resource
win7-20220414-en
General
-
Target
Invoice B9800177.exe
-
Size
628KB
-
MD5
36efa9e34b8055b9e54572997f85099a
-
SHA1
ceeb08b5411a56c0fc98388bc427b9aa563d8967
-
SHA256
b87ec1a86d0c11e1183ec3de93241427e393f0016ff662fe6c9d98af2faf22d5
-
SHA512
e4bbdaad01e7da77457af0420e9f777f59ec08cebc728b6396696317c69329d6c5a385b584abd642f92138324838e9df347b8f61f346aad9583eac115f1a2413
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/948-63-0x0000000000400000-0x000000000042D000-memory.dmp xloader behavioral1/memory/948-64-0x00000000004202C0-mapping.dmp xloader behavioral1/memory/948-66-0x0000000000400000-0x000000000042D000-memory.dmp xloader behavioral1/memory/1420-73-0x00000000000E0000-0x000000000010D000-memory.dmp xloader behavioral1/memory/1420-77-0x00000000000E0000-0x000000000010D000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Invoice B9800177.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation Invoice B9800177.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 696 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wlanext.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wlanext.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\8PTXHFWXGV = "C:\\Program Files (x86)\\J-zftcn\\config9rql.exe" wlanext.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Invoice B9800177.exeInvoice B9800177.exewlanext.exedescription pid process target process PID 1684 set thread context of 948 1684 Invoice B9800177.exe Invoice B9800177.exe PID 948 set thread context of 1264 948 Invoice B9800177.exe Explorer.EXE PID 1420 set thread context of 1264 1420 wlanext.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
wlanext.exedescription ioc process File opened for modification C:\Program Files (x86)\J-zftcn\config9rql.exe wlanext.exe -
Processes:
wlanext.exedescription ioc process Key created \Registry\User\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wlanext.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
Invoice B9800177.exewlanext.exepid process 948 Invoice B9800177.exe 948 Invoice B9800177.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Invoice B9800177.exewlanext.exepid process 948 Invoice B9800177.exe 948 Invoice B9800177.exe 948 Invoice B9800177.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe 1420 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Invoice B9800177.exewlanext.exedescription pid process Token: SeDebugPrivilege 948 Invoice B9800177.exe Token: SeDebugPrivilege 1420 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Invoice B9800177.exeExplorer.EXEwlanext.exedescription pid process target process PID 1684 wrote to memory of 948 1684 Invoice B9800177.exe Invoice B9800177.exe PID 1684 wrote to memory of 948 1684 Invoice B9800177.exe Invoice B9800177.exe PID 1684 wrote to memory of 948 1684 Invoice B9800177.exe Invoice B9800177.exe PID 1684 wrote to memory of 948 1684 Invoice B9800177.exe Invoice B9800177.exe PID 1684 wrote to memory of 948 1684 Invoice B9800177.exe Invoice B9800177.exe PID 1684 wrote to memory of 948 1684 Invoice B9800177.exe Invoice B9800177.exe PID 1684 wrote to memory of 948 1684 Invoice B9800177.exe Invoice B9800177.exe PID 1264 wrote to memory of 1420 1264 Explorer.EXE wlanext.exe PID 1264 wrote to memory of 1420 1264 Explorer.EXE wlanext.exe PID 1264 wrote to memory of 1420 1264 Explorer.EXE wlanext.exe PID 1264 wrote to memory of 1420 1264 Explorer.EXE wlanext.exe PID 1420 wrote to memory of 696 1420 wlanext.exe cmd.exe PID 1420 wrote to memory of 696 1420 wlanext.exe cmd.exe PID 1420 wrote to memory of 696 1420 wlanext.exe cmd.exe PID 1420 wrote to memory of 696 1420 wlanext.exe cmd.exe PID 1420 wrote to memory of 1988 1420 wlanext.exe Firefox.exe PID 1420 wrote to memory of 1988 1420 wlanext.exe Firefox.exe PID 1420 wrote to memory of 1988 1420 wlanext.exe Firefox.exe PID 1420 wrote to memory of 1988 1420 wlanext.exe Firefox.exe PID 1420 wrote to memory of 1988 1420 wlanext.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice B9800177.exe"C:\Users\Admin\AppData\Local\Temp\Invoice B9800177.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice B9800177.exe"C:\Users\Admin\AppData\Local\Temp\Invoice B9800177.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Invoice B9800177.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/696-71-0x0000000000000000-mapping.dmp
-
memory/948-66-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/948-68-0x0000000000270000-0x0000000000281000-memory.dmpFilesize
68KB
-
memory/948-67-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/948-60-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/948-61-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/948-63-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/948-64-0x00000000004202C0-mapping.dmp
-
memory/1264-78-0x00000000068F0000-0x0000000006A69000-memory.dmpFilesize
1.5MB
-
memory/1264-76-0x00000000068F0000-0x0000000006A69000-memory.dmpFilesize
1.5MB
-
memory/1264-69-0x0000000004D40000-0x0000000004DFA000-memory.dmpFilesize
744KB
-
memory/1420-73-0x00000000000E0000-0x000000000010D000-memory.dmpFilesize
180KB
-
memory/1420-70-0x0000000000000000-mapping.dmp
-
memory/1420-72-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/1420-74-0x0000000001ED0000-0x00000000021D3000-memory.dmpFilesize
3.0MB
-
memory/1420-75-0x0000000001D70000-0x0000000001E00000-memory.dmpFilesize
576KB
-
memory/1420-77-0x00000000000E0000-0x000000000010D000-memory.dmpFilesize
180KB
-
memory/1684-57-0x0000000000280000-0x000000000028E000-memory.dmpFilesize
56KB
-
memory/1684-54-0x0000000000290000-0x0000000000334000-memory.dmpFilesize
656KB
-
memory/1684-55-0x0000000075761000-0x0000000075763000-memory.dmpFilesize
8KB
-
memory/1684-56-0x00000000003E0000-0x0000000000400000-memory.dmpFilesize
128KB
-
memory/1684-59-0x00000000020F0000-0x0000000002122000-memory.dmpFilesize
200KB
-
memory/1684-58-0x0000000005F50000-0x0000000005FCA000-memory.dmpFilesize
488KB