Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
- submitted
10/08/2022, 08:23
General
- Target PO.exe
- Size 640KB
- Sample220810-j944dahea4
- SHA256 bf229f5e63a19ca8043605dc5bf8e34f1aee23edad8f172d9a563a73356264ae
Malware Config
Extracted
-
xloader
-
2.9
-
zzun
-
JnNtRHyNupy0GqRzAcasu7hb4rc=
-
Qv593NGLE7p9UNSaVkPXljAJm2QCNnc=
-
ePArIFWvjkkMgVEVhw4M4Jk=
-
26rqUwJ7dD0AiDI=
-
pBAxMHeK741QFw==
-
kHD7TPt5846pUMTX
-
56UnjFjHL1i0j659h3LymRnHpQj+SshC
-
4vKlKHflPqmWXRbrRwfPtrhb4rc=
-
6LBd4qButFAi
-
phMzGll8Ue7Fu+inq5cdnPaSugG3
-
NKswiQGCvZoG5FgsdHEI
-
rtTHnuUY8M1qVcXV
-
SOmECrlAt2oGAA==
-
L1ep9adutFAi
-
/UE+/AyvE6uEl28weFI=
-
IP+xMPQxJR4NE6TK
-
xvW5GN9/rqA5YUoOVt185Sf7Uw==
-
fRFNW9DhxL6VF7LA
-
KFYTfkaY741QFw==
-
W4JGvMBmt2oGAA==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Program Files directory 1 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 47 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO.exe"C:\Users\Admin\AppData\Local\Temp\PO.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO.exe"{path}"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
DB1
memory/2164-136-0x0000000000400000-0x000000000042C000-memory.dmp
memory/2164-142-0x0000000000400000-0x000000000042C000-memory.dmp
memory/2164-138-0x0000000001120000-0x000000000146A000-memory.dmp
memory/2164-139-0x0000000000C60000-0x0000000000C71000-memory.dmp
memory/2624-150-0x0000000007B20000-0x0000000007C62000-memory.dmp
memory/2624-148-0x0000000007B20000-0x0000000007C62000-memory.dmp
memory/2624-140-0x00000000079D0000-0x0000000007B1F000-memory.dmp
memory/3548-147-0x0000000001440000-0x00000000014D0000-memory.dmp
memory/3548-144-0x0000000000170000-0x000000000017B000-memory.dmp
memory/3548-145-0x0000000000BB0000-0x0000000000BDC000-memory.dmp
memory/3548-146-0x0000000001630000-0x000000000197A000-memory.dmp
memory/3548-149-0x0000000000BB0000-0x0000000000BDC000-memory.dmp
memory/4616-133-0x0000000005460000-0x00000000054FC000-memory.dmp
memory/4616-134-0x00000000053D0000-0x00000000053DA000-memory.dmp
memory/4616-130-0x0000000000880000-0x0000000000924000-memory.dmp
memory/4616-132-0x0000000005320000-0x00000000053B2000-memory.dmp
memory/4616-131-0x00000000058D0000-0x0000000005E74000-memory.dmp