Analysis
- max time kernel
149s - max time network
152s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
19/08/2022, 02:36
General
- Target Quotation-17-08-22.exe
- Size 617KB
- Sample220819-c3k9csfcap
- SHA256 d55b3acb7fbeaf698e8b940f755c1363224663da98feee5abf93872e979460e9
Malware Config
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 6 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Program Files directory 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation-17-08-22.exe"C:\Users\Admin\AppData\Local\Temp\Quotation-17-08-22.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation-17-08-22.exe"C:\Users\Admin\AppData\Local\Temp\Quotation-17-08-22.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation-17-08-22.exe"3⤵
- Deletes itself
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/864-58-0x0000000004D50000-0x0000000004DD6000-memory.dmp
memory/864-56-0x0000000000720000-0x000000000073A000-memory.dmp
memory/864-57-0x0000000000900000-0x000000000090C000-memory.dmp
memory/864-55-0x0000000076321000-0x0000000076323000-memory.dmp
memory/864-59-0x0000000001F70000-0x0000000001FB2000-memory.dmp
memory/864-54-0x0000000000340000-0x00000000003E0000-memory.dmp
memory/956-79-0x0000000000800000-0x0000000000890000-memory.dmp
memory/956-81-0x00000000000C0000-0x00000000000ED000-memory.dmp
memory/956-78-0x0000000002030000-0x0000000002333000-memory.dmp
memory/956-76-0x00000000000C0000-0x00000000000ED000-memory.dmp
memory/956-75-0x00000000008F0000-0x000000000090A000-memory.dmp
memory/1236-83-0x0000000006DA0000-0x0000000006F1D000-memory.dmp
memory/1236-80-0x0000000006DA0000-0x0000000006F1D000-memory.dmp
memory/1236-69-0x0000000006170000-0x0000000006307000-memory.dmp
memory/1236-72-0x00000000063B0000-0x00000000064C4000-memory.dmp
memory/2008-60-0x0000000000400000-0x000000000042D000-memory.dmp
memory/2008-74-0x0000000000400000-0x000000000042D000-memory.dmp
memory/2008-71-0x0000000000180000-0x0000000000191000-memory.dmp
memory/2008-68-0x0000000000130000-0x0000000000141000-memory.dmp
memory/2008-67-0x0000000000910000-0x0000000000C13000-memory.dmp
memory/2008-66-0x0000000000400000-0x000000000042D000-memory.dmp
memory/2008-63-0x0000000000400000-0x000000000042D000-memory.dmp
memory/2008-61-0x0000000000400000-0x000000000042D000-memory.dmp