Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    08-08-2022 15:51

General

  • Target

    0098764345678.exe

  • Size

    815KB

  • MD5

    69ec82c711ed34399013471e214a7e64

  • SHA1

    f7fd0fc9eb038b2debf63b0ebec21f48c3fffdd4

  • SHA256

    f71f9af9db20ea569e9a4b528898183f182a9d98a6f8668275c55690b5a59c49

  • SHA512

    c754f373d1ffc031c50ade5a01361db53dded163e050b53fdb050fc450f2342efd40234fbf9bda15fbbc6509f66cd3bbd8fa13e32e436051cd84adce4f31e173

Malware Config

Extracted

Family

xloader

Version

2.9

Campaign

zzun

Decoy

JnNtRHyNupy0GqRzAcasu7hb4rc=

Qv593NGLE7p9UNSaVkPXljAJm2QCNnc=

ePArIFWvjkkMgVEVhw4M4Jk=

26rqUwJ7dD0AiDI=

pBAxMHeK741QFw==

kHD7TPt5846pUMTX

56UnjFjHL1i0j659h3LymRnHpQj+SshC

4vKlKHflPqmWXRbrRwfPtrhb4rc=

6LBd4qButFAi

phMzGll8Ue7Fu+inq5cdnPaSugG3

NKswiQGCvZoG5FgsdHEI

rtTHnuUY8M1qVcXV

SOmECrlAt2oGAA==

L1ep9adutFAi

/UE+/AyvE6uEl28weFI=

IP+xMPQxJR4NE6TK

xvW5GN9/rqA5YUoOVt185Sf7Uw==

fRFNW9DhxL6VF7LA

KFYTfkaY741QFw==

W4JGvMBmt2oGAA==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 6 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1412
    • C:\Users\Admin\AppData\Local\Temp\0098764345678.exe
      "C:\Users\Admin\AppData\Local\Temp\0098764345678.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\0098764345678.exe
        "{path}"
        3⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\SysWOW64\msiexec.exe
          "C:\Windows\SysWOW64\msiexec.exe"
          4⤵
          • Adds policy Run key to start application
          • Suspicious use of SetThreadContext
          • Drops file in Program Files directory
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:656
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\0098764345678.exe"
            5⤵
            • Deletes itself
            PID:1488
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            5⤵
              PID:780

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    2
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/656-80-0x0000000000110000-0x000000000013C000-memory.dmp
      Filesize

      176KB

    • memory/656-71-0x0000000000000000-mapping.dmp
    • memory/656-75-0x0000000000EF0000-0x0000000000F04000-memory.dmp
      Filesize

      80KB

    • memory/656-77-0x0000000002310000-0x0000000002613000-memory.dmp
      Filesize

      3.0MB

    • memory/656-76-0x0000000000110000-0x000000000013C000-memory.dmp
      Filesize

      176KB

    • memory/656-78-0x0000000000C50000-0x0000000000CE0000-memory.dmp
      Filesize

      576KB

    • memory/1204-58-0x0000000004CB0000-0x0000000004D0E000-memory.dmp
      Filesize

      376KB

    • memory/1204-54-0x0000000000DB0000-0x0000000000E82000-memory.dmp
      Filesize

      840KB

    • memory/1204-57-0x00000000051C0000-0x0000000005270000-memory.dmp
      Filesize

      704KB

    • memory/1204-56-0x0000000000510000-0x000000000051A000-memory.dmp
      Filesize

      40KB

    • memory/1204-55-0x00000000754C1000-0x00000000754C3000-memory.dmp
      Filesize

      8KB

    • memory/1412-79-0x0000000003D00000-0x0000000003D9A000-memory.dmp
      Filesize

      616KB

    • memory/1412-81-0x0000000003D00000-0x0000000003D9A000-memory.dmp
      Filesize

      616KB

    • memory/1412-67-0x0000000004D10000-0x0000000004E38000-memory.dmp
      Filesize

      1.2MB

    • memory/1412-70-0x00000000064B0000-0x00000000065CB000-memory.dmp
      Filesize

      1.1MB

    • memory/1488-74-0x0000000000000000-mapping.dmp
    • memory/2028-60-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

    • memory/2028-72-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

    • memory/2028-69-0x0000000000360000-0x0000000000371000-memory.dmp
      Filesize

      68KB

    • memory/2028-68-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

    • memory/2028-66-0x0000000000320000-0x0000000000331000-memory.dmp
      Filesize

      68KB

    • memory/2028-65-0x0000000000880000-0x0000000000B83000-memory.dmp
      Filesize

      3.0MB

    • memory/2028-63-0x000000000041F6F0-mapping.dmp
    • memory/2028-62-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

    • memory/2028-59-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB