General
-
Target
Payment_Advice.exe
-
Size
709KB
-
Sample
220718-s9bw9sgfh5
-
MD5
7ca80ef9cefc1bdf4d249e5a1b263672
-
SHA1
21acb1e653f73e26528839c7fef847d5b6734b0a
-
SHA256
34b54e55317003a0a2b8ff85ffa516a441d996a9f78fb074d6006cc40f3bd46f
-
SHA512
8bca4da57b2d34e3b7a0976ca74674429608986b3a82901ef6ecec6d5bc37b3c3753e657b69c021dbdb870ffdf1bc50afd4fc557a2f93cd7d5ce9fe516293f30
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Advice.exe
Resource
win7-20220715-en
Malware Config
Extracted
xloader
2.9
zzun
JnNtRHyNupy0GqRzAcasu7hb4rc=
Qv593NGLE7p9UNSaVkPXljAJm2QCNnc=
ePArIFWvjkkMgVEVhw4M4Jk=
26rqUwJ7dD0AiDI=
pBAxMHeK741QFw==
kHD7TPt5846pUMTX
56UnjFjHL1i0j659h3LymRnHpQj+SshC
4vKlKHflPqmWXRbrRwfPtrhb4rc=
6LBd4qButFAi
phMzGll8Ue7Fu+inq5cdnPaSugG3
NKswiQGCvZoG5FgsdHEI
rtTHnuUY8M1qVcXV
SOmECrlAt2oGAA==
L1ep9adutFAi
/UE+/AyvE6uEl28weFI=
IP+xMPQxJR4NE6TK
xvW5GN9/rqA5YUoOVt185Sf7Uw==
fRFNW9DhxL6VF7LA
KFYTfkaY741QFw==
W4JGvMBmt2oGAA==
lnoad0Hkgrwl9uXlghvqdz33UA==
1msShiu+9wisELGDjYAK
FBXFOinAK8ylnMZzi35Okw==
V8Y7/cBnt2oGAA==
VfuI0k5pSmi6+aNjIlAT2mspCZBZLGA=
de74yg89D61bSiU=
V2UPjYUvwh21qdxUr4Mf
DcFXvTxFMlyfL5JJIU0=
GldbH/CCt2oGAA==
sxdEIBwn+o+pUMTX
UmViK+1/Knr8814sdHEI
jrfKoZ6paLyeEBETgw4M4Jk=
SR27MizpGwCa19Kb1A==
2DGo9XUNxBOe19Kb1A==
7tBn2cG8jasWHE7w559Aig==
8qtAoVHxl/KGerbsfA4M4Jk=
fC3AH6Utt2oGAA==
HltlPHZ7FpSpUMTX
xd0B+Pr30gBfQGYXafOW1dOSflv+SshC
DKXWyiOecY7319Kb1A==
Pvx505EaswiHYF3z559Aig==
aJ6kaz7CWKsP9g9Ur4Mf
qcvfxb9TwUoDCrfXw/uTdSkTCJBZLGA=
I++iH8xJxFp73nyUjJOg3/PS/3W7
K1N1guwbLz0AiDI=
vp2SfavTmBXNzLeXmIoUhsB7
UlAVhgIfLT0AiDI=
6BKH5GjHt2YIo/qhA69S+5E=
6U29K+qVw5hT4gQ83A==
G9NTmhwpAwY6r4I69kT4dz33UA==
0qstoaNBmBrMlfwTKhrAtLhb4rc=
ZvMhGW52cyAAXkVV3Jc96Lhb4rc=
N9Z3/PmEt2oGAA==
ohlOhcaP741QFw==
9WF3PohVjEolhCY=
am0ek4wtmkEI9GMVhw4M4Jk=
ROotH4+jhp7vnzVdww==
uvkuFhGmJlyjpFFpi35Okw==
ICHQQTIjaxTryG8weFI=
AhIZ8uh974+pUMTX
pEBtSFHr/5s0GQ==
qAcuLnqLNeOpUMTX
bcHv6WdbHoWEylgsdHEI
Nz/rbWh3s4WFDL9uPlAhXKNz
secure-id6793-chase.com
Targets
-
-
Target
Payment_Advice.exe
-
Size
709KB
-
MD5
7ca80ef9cefc1bdf4d249e5a1b263672
-
SHA1
21acb1e653f73e26528839c7fef847d5b6734b0a
-
SHA256
34b54e55317003a0a2b8ff85ffa516a441d996a9f78fb074d6006cc40f3bd46f
-
SHA512
8bca4da57b2d34e3b7a0976ca74674429608986b3a82901ef6ecec6d5bc37b3c3753e657b69c021dbdb870ffdf1bc50afd4fc557a2f93cd7d5ce9fe516293f30
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Xloader payload
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-