Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 03:53
Static task
static1
Behavioral task
behavioral1
Sample
STD 35 GA Plan_DOCX.exe
Resource
win7-20220414-en
General
-
Target
STD 35 GA Plan_DOCX.exe
-
Size
681KB
-
MD5
1cb1b73c99d72a4d1dcc09858ad1cee5
-
SHA1
76a12baf54b1f66fbccc3728d3e1fc1ca663c6ee
-
SHA256
ef5551b32efae3527d147f40eaac18ab0213b7382d5d54bc67fd1c9911007480
-
SHA512
1206dc9ff04af0d47b96a9e7598fa72626f4d56d0f515ce77ab5d0239a5fa9a1f2d67ba72f0354ed77736078cf466814f7ab5b9497d31a0ef7213cec4e332682
Malware Config
Extracted
xloader
2.9
iewb
n8FLlgIlb1rSEg5hJ9xMbw4hcmR38Q==
5vIAIY+pt81OtWs+FdIEdk7Y
LHIKc+oWGIQUUlfAAtEEdk7Y
ePM/cX2jvHrS
5hvPEw22+fdvmJz3C8FIVq0=
mb9EeX2jvHrS
Dx2zIYNvfjo8VUo5
6jVPnyJekv2RAc4gLKNwEqQ=
KWatHyjdE5Gj1Ng=
t9lk70gzUAZty4qjbVjF
6eUBeFPzKBWT125BFNIEdk7Y
dZUXOIyqTJGj1Ng=
iL3TVh2Jl5QVStnzxcAhIL8=
J1prtyklUfZGR/xDD71IbkWRd2yx
s9FgCOBRW9bU0Y6jbVjF
RYCbQDzcFBhcylgu
Fl0BV/8RJm6F9QRg8LXXTLo=
0dhumHzrCCZ3wdQg7nFF1AlL6Tk=
xvL+iL6wwX+/wH9K4lbZ/A==
N0lVceIFD5Gj1Ng=
5/mnQbHhJ7IzcYjyQbXXTLo=
luHuIKrfNeUkJOfRV0dA8o3Ghkt95g==
yuh2thpBWtHl2ZV48rXXTLo=
ADcuaODkD5eytord4lbZ/A==
PIWRAgq8/zx4aipDyILc
TdUPJBksRZU=
NorCQjrrH5Gj1Ng=
WXUOku0EDZGj1Ng=
4w8mrX8lanCcoWZLU0SkkkSRd2yx
KIYkq/0QN5gPTFK37XszY0fa
s8lIykhdVZjlEA1g8LXXTLo=
AkBw4LE9RQNHkyRsMQ==
fLzVWEjyMarikyRsMQ==
6j1f2ZsFFRpcylgu
zu3YwbBReoIuUh1vdsGonTCDfw==
EGD0PEju53oDSuwu9765d/4KSkXU3Qxh
rc0aZhksRZU=
Un//ZcCsqyaNtEcnt6mLu7Lqdw==
V4Eqwh4FEHqIflW508EYzYSbOeC5
EiWpwJgAFRV5e1r60cAEdk7Y
VW8Pf9PN65HU1otP4lbZ/A==
FFdOyJcMGxpcylgu
KztLpY85vJkLFw==
yh8vtO4GRPQ2kyRsMQ==
qMfrSiqZvghLUyRy/7XXTLo=
eKTGPwmf3swEq2Y3
aoseYSTrlPsvGQ==
Z6tKw0RfgS5+1o6jbVjF
CyU0azDFBZGj1Ng=
7Cy+5co/ZZbhC8dW6eo=
LXmN0EJimQWHylwnbTS6afIlJZHj+Q==
2R2cFWiX1hlZYz2UKh4i12ikiTP55p5Bfg==
jqHcD+eAi5EYlVrJm0TN
cqO55WilyvQ9mG1P4lbZ/A==
BERqtpY6pZDbB8dW6eo=
VpzDHQBueZvY24qjbVjF
OWUELQ6s28NVxom7evrIPfCLfw==
5iO6Dg619fIVQz+Q3I+ZMdmwry4=
d6GiFh7QJaHO2Jxz8bXXTLo=
NlFh6bdVeihxxT1MH+A+TL3MaA==
0PWJHpPJ9zh3nasMO8FIVq0=
19Fom6FBSQ1QrMU=
aYWBmw6431DfHsdW6eo=
Jj7U++2X3M4Eq2Y3
mounscape.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1876-63-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1876-64-0x000000000041F840-mapping.dmp xloader behavioral1/memory/1876-69-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1876-73-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/596-76-0x0000000000080000-0x00000000000AC000-memory.dmp xloader behavioral1/memory/596-80-0x0000000000080000-0x00000000000AC000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
STD 35 GA Plan_DOCX.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation STD 35 GA Plan_DOCX.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 784 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
STD 35 GA Plan_DOCX.exeSTD 35 GA Plan_DOCX.exechkdsk.exedescription pid process target process PID 1336 set thread context of 1876 1336 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 1876 set thread context of 1260 1876 STD 35 GA Plan_DOCX.exe Explorer.EXE PID 1876 set thread context of 1260 1876 STD 35 GA Plan_DOCX.exe Explorer.EXE PID 596 set thread context of 1260 596 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
STD 35 GA Plan_DOCX.exechkdsk.exepid process 1876 STD 35 GA Plan_DOCX.exe 1876 STD 35 GA Plan_DOCX.exe 1876 STD 35 GA Plan_DOCX.exe 596 chkdsk.exe 596 chkdsk.exe 596 chkdsk.exe 596 chkdsk.exe 596 chkdsk.exe 596 chkdsk.exe 596 chkdsk.exe 596 chkdsk.exe 596 chkdsk.exe 596 chkdsk.exe 596 chkdsk.exe 596 chkdsk.exe 596 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
STD 35 GA Plan_DOCX.exechkdsk.exepid process 1876 STD 35 GA Plan_DOCX.exe 1876 STD 35 GA Plan_DOCX.exe 1876 STD 35 GA Plan_DOCX.exe 1876 STD 35 GA Plan_DOCX.exe 596 chkdsk.exe 596 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
STD 35 GA Plan_DOCX.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1876 STD 35 GA Plan_DOCX.exe Token: SeDebugPrivilege 596 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
STD 35 GA Plan_DOCX.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1336 wrote to memory of 1876 1336 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 1336 wrote to memory of 1876 1336 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 1336 wrote to memory of 1876 1336 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 1336 wrote to memory of 1876 1336 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 1336 wrote to memory of 1876 1336 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 1336 wrote to memory of 1876 1336 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 1336 wrote to memory of 1876 1336 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 1260 wrote to memory of 596 1260 Explorer.EXE chkdsk.exe PID 1260 wrote to memory of 596 1260 Explorer.EXE chkdsk.exe PID 1260 wrote to memory of 596 1260 Explorer.EXE chkdsk.exe PID 1260 wrote to memory of 596 1260 Explorer.EXE chkdsk.exe PID 596 wrote to memory of 784 596 chkdsk.exe cmd.exe PID 596 wrote to memory of 784 596 chkdsk.exe cmd.exe PID 596 wrote to memory of 784 596 chkdsk.exe cmd.exe PID 596 wrote to memory of 784 596 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/596-72-0x0000000000000000-mapping.dmp
-
memory/596-80-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/596-78-0x0000000001F20000-0x0000000001FB0000-memory.dmpFilesize
576KB
-
memory/596-77-0x0000000002020000-0x0000000002323000-memory.dmpFilesize
3.0MB
-
memory/596-76-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/596-75-0x0000000000A80000-0x0000000000A87000-memory.dmpFilesize
28KB
-
memory/784-74-0x0000000000000000-mapping.dmp
-
memory/1260-68-0x00000000073B0000-0x0000000007558000-memory.dmpFilesize
1.7MB
-
memory/1260-71-0x0000000004390000-0x0000000004450000-memory.dmpFilesize
768KB
-
memory/1260-81-0x0000000007560000-0x00000000076DE000-memory.dmpFilesize
1.5MB
-
memory/1260-79-0x0000000007560000-0x00000000076DE000-memory.dmpFilesize
1.5MB
-
memory/1336-58-0x0000000005210000-0x000000000528A000-memory.dmpFilesize
488KB
-
memory/1336-59-0x0000000004EB0000-0x0000000004EE2000-memory.dmpFilesize
200KB
-
memory/1336-55-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/1336-56-0x0000000000580000-0x00000000005A0000-memory.dmpFilesize
128KB
-
memory/1336-54-0x00000000010C0000-0x0000000001170000-memory.dmpFilesize
704KB
-
memory/1336-57-0x0000000000A40000-0x0000000000A4E000-memory.dmpFilesize
56KB
-
memory/1876-67-0x0000000000350000-0x0000000000361000-memory.dmpFilesize
68KB
-
memory/1876-60-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1876-73-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1876-63-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1876-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1876-70-0x0000000000390000-0x00000000003A1000-memory.dmpFilesize
68KB
-
memory/1876-66-0x0000000000880000-0x0000000000B83000-memory.dmpFilesize
3.0MB
-
memory/1876-69-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1876-64-0x000000000041F840-mapping.dmp