Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 03:53
Static task
static1
Behavioral task
behavioral1
Sample
STD 35 GA Plan_DOCX.exe
Resource
win7-20220414-en
General
-
Target
STD 35 GA Plan_DOCX.exe
-
Size
681KB
-
MD5
1cb1b73c99d72a4d1dcc09858ad1cee5
-
SHA1
76a12baf54b1f66fbccc3728d3e1fc1ca663c6ee
-
SHA256
ef5551b32efae3527d147f40eaac18ab0213b7382d5d54bc67fd1c9911007480
-
SHA512
1206dc9ff04af0d47b96a9e7598fa72626f4d56d0f515ce77ab5d0239a5fa9a1f2d67ba72f0354ed77736078cf466814f7ab5b9497d31a0ef7213cec4e332682
Malware Config
Extracted
xloader
2.9
iewb
n8FLlgIlb1rSEg5hJ9xMbw4hcmR38Q==
5vIAIY+pt81OtWs+FdIEdk7Y
LHIKc+oWGIQUUlfAAtEEdk7Y
ePM/cX2jvHrS
5hvPEw22+fdvmJz3C8FIVq0=
mb9EeX2jvHrS
Dx2zIYNvfjo8VUo5
6jVPnyJekv2RAc4gLKNwEqQ=
KWatHyjdE5Gj1Ng=
t9lk70gzUAZty4qjbVjF
6eUBeFPzKBWT125BFNIEdk7Y
dZUXOIyqTJGj1Ng=
iL3TVh2Jl5QVStnzxcAhIL8=
J1prtyklUfZGR/xDD71IbkWRd2yx
s9FgCOBRW9bU0Y6jbVjF
RYCbQDzcFBhcylgu
Fl0BV/8RJm6F9QRg8LXXTLo=
0dhumHzrCCZ3wdQg7nFF1AlL6Tk=
xvL+iL6wwX+/wH9K4lbZ/A==
N0lVceIFD5Gj1Ng=
5/mnQbHhJ7IzcYjyQbXXTLo=
luHuIKrfNeUkJOfRV0dA8o3Ghkt95g==
yuh2thpBWtHl2ZV48rXXTLo=
ADcuaODkD5eytord4lbZ/A==
PIWRAgq8/zx4aipDyILc
TdUPJBksRZU=
NorCQjrrH5Gj1Ng=
WXUOku0EDZGj1Ng=
4w8mrX8lanCcoWZLU0SkkkSRd2yx
KIYkq/0QN5gPTFK37XszY0fa
s8lIykhdVZjlEA1g8LXXTLo=
AkBw4LE9RQNHkyRsMQ==
fLzVWEjyMarikyRsMQ==
6j1f2ZsFFRpcylgu
zu3YwbBReoIuUh1vdsGonTCDfw==
EGD0PEju53oDSuwu9765d/4KSkXU3Qxh
rc0aZhksRZU=
Un//ZcCsqyaNtEcnt6mLu7Lqdw==
V4Eqwh4FEHqIflW508EYzYSbOeC5
EiWpwJgAFRV5e1r60cAEdk7Y
VW8Pf9PN65HU1otP4lbZ/A==
FFdOyJcMGxpcylgu
KztLpY85vJkLFw==
yh8vtO4GRPQ2kyRsMQ==
qMfrSiqZvghLUyRy/7XXTLo=
eKTGPwmf3swEq2Y3
aoseYSTrlPsvGQ==
Z6tKw0RfgS5+1o6jbVjF
CyU0azDFBZGj1Ng=
7Cy+5co/ZZbhC8dW6eo=
LXmN0EJimQWHylwnbTS6afIlJZHj+Q==
2R2cFWiX1hlZYz2UKh4i12ikiTP55p5Bfg==
jqHcD+eAi5EYlVrJm0TN
cqO55WilyvQ9mG1P4lbZ/A==
BERqtpY6pZDbB8dW6eo=
VpzDHQBueZvY24qjbVjF
OWUELQ6s28NVxom7evrIPfCLfw==
5iO6Dg619fIVQz+Q3I+ZMdmwry4=
d6GiFh7QJaHO2Jxz8bXXTLo=
NlFh6bdVeihxxT1MH+A+TL3MaA==
0PWJHpPJ9zh3nasMO8FIVq0=
19Fom6FBSQ1QrMU=
aYWBmw6431DfHsdW6eo=
Jj7U++2X3M4Eq2Y3
mounscape.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2308-138-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/2308-140-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/2808-146-0x0000000000B20000-0x0000000000B4C000-memory.dmp xloader behavioral2/memory/2808-149-0x0000000000B20000-0x0000000000B4C000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
STD 35 GA Plan_DOCX.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation STD 35 GA Plan_DOCX.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
STD 35 GA Plan_DOCX.exeSTD 35 GA Plan_DOCX.execscript.exedescription pid process target process PID 2912 set thread context of 2308 2912 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 2308 set thread context of 2952 2308 STD 35 GA Plan_DOCX.exe Explorer.EXE PID 2808 set thread context of 2952 2808 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
STD 35 GA Plan_DOCX.exeSTD 35 GA Plan_DOCX.execscript.exepid process 2912 STD 35 GA Plan_DOCX.exe 2912 STD 35 GA Plan_DOCX.exe 2308 STD 35 GA Plan_DOCX.exe 2308 STD 35 GA Plan_DOCX.exe 2308 STD 35 GA Plan_DOCX.exe 2308 STD 35 GA Plan_DOCX.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe 2808 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2952 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
STD 35 GA Plan_DOCX.execscript.exepid process 2308 STD 35 GA Plan_DOCX.exe 2308 STD 35 GA Plan_DOCX.exe 2308 STD 35 GA Plan_DOCX.exe 2808 cscript.exe 2808 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
STD 35 GA Plan_DOCX.exeSTD 35 GA Plan_DOCX.execscript.exedescription pid process Token: SeDebugPrivilege 2912 STD 35 GA Plan_DOCX.exe Token: SeDebugPrivilege 2308 STD 35 GA Plan_DOCX.exe Token: SeDebugPrivilege 2808 cscript.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
STD 35 GA Plan_DOCX.exeExplorer.EXEcscript.exedescription pid process target process PID 2912 wrote to memory of 1344 2912 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 2912 wrote to memory of 1344 2912 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 2912 wrote to memory of 1344 2912 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 2912 wrote to memory of 2308 2912 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 2912 wrote to memory of 2308 2912 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 2912 wrote to memory of 2308 2912 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 2912 wrote to memory of 2308 2912 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 2912 wrote to memory of 2308 2912 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 2912 wrote to memory of 2308 2912 STD 35 GA Plan_DOCX.exe STD 35 GA Plan_DOCX.exe PID 2952 wrote to memory of 2808 2952 Explorer.EXE cscript.exe PID 2952 wrote to memory of 2808 2952 Explorer.EXE cscript.exe PID 2952 wrote to memory of 2808 2952 Explorer.EXE cscript.exe PID 2808 wrote to memory of 2248 2808 cscript.exe cmd.exe PID 2808 wrote to memory of 2248 2808 cscript.exe cmd.exe PID 2808 wrote to memory of 2248 2808 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\STD 35 GA Plan_DOCX.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1344-136-0x0000000000000000-mapping.dmp
-
memory/2248-147-0x0000000000000000-mapping.dmp
-
memory/2308-137-0x0000000000000000-mapping.dmp
-
memory/2308-142-0x0000000000E80000-0x0000000000E91000-memory.dmpFilesize
68KB
-
memory/2308-141-0x0000000000F00000-0x000000000124A000-memory.dmpFilesize
3.3MB
-
memory/2308-140-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2308-138-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2808-146-0x0000000000B20000-0x0000000000B4C000-memory.dmpFilesize
176KB
-
memory/2808-148-0x0000000002B60000-0x0000000002EAA000-memory.dmpFilesize
3.3MB
-
memory/2808-149-0x0000000000B20000-0x0000000000B4C000-memory.dmpFilesize
176KB
-
memory/2808-150-0x0000000002A80000-0x0000000002B10000-memory.dmpFilesize
576KB
-
memory/2808-145-0x0000000000B60000-0x0000000000B87000-memory.dmpFilesize
156KB
-
memory/2808-144-0x0000000000000000-mapping.dmp
-
memory/2912-132-0x0000000004BC0000-0x0000000004C52000-memory.dmpFilesize
584KB
-
memory/2912-130-0x0000000000110000-0x00000000001C0000-memory.dmpFilesize
704KB
-
memory/2912-131-0x00000000050D0000-0x0000000005674000-memory.dmpFilesize
5.6MB
-
memory/2912-135-0x00000000008B0000-0x0000000000916000-memory.dmpFilesize
408KB
-
memory/2912-133-0x0000000004B40000-0x0000000004B4A000-memory.dmpFilesize
40KB
-
memory/2912-134-0x0000000007290000-0x000000000732C000-memory.dmpFilesize
624KB
-
memory/2952-143-0x0000000007FD0000-0x0000000008114000-memory.dmpFilesize
1.3MB
-
memory/2952-151-0x0000000008120000-0x0000000008281000-memory.dmpFilesize
1.4MB
-
memory/2952-152-0x0000000008120000-0x0000000008281000-memory.dmpFilesize
1.4MB