Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19-09-2022 08:59

General

  • Target

    492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe

  • Size

    967KB

  • MD5

    37840d4e937db0385b820d4019071540

  • SHA1

    a1f7670cd7da7e331db2d69f0855858985819873

  • SHA256

    492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852

  • SHA512

    4a77875a5f9b9066ca6f88ad1ea7c259bb690e3b2c240a3de61081c01f06d87a1cae261b236c7a8b0c7261399a06e1ff3cbbdeb1ca1ee5b732350143eafb51a6

  • SSDEEP

    12288:8HbINWvoTEQYJGl/iUfkcogKuqAJA+1z48qDo5ynuzFl2LUv0eMqnexYA1l/X:6b6ZeGBiAkcogKOi+1zSo5ynRxYA7/X

Malware Config

Extracted

Family

formbook

Campaign

od65

Decoy

oMDl7+9m1JtQ+KJ//bSZYk7C

0nQRVuikEsWM9KcRhRk=

VXATJsbZt/OyEi6Z0Y9m9O4=

C8ZitXuEXIk613jZWQ==

4IIRKYI2mygmEr7EUhOuiEZ1ux4c

x3mNjz4y4M20lnKM1I9m9O4=

UGB//3QuqmDHeDQ=

2H5k5/UwHEwPv2G+Sg==

xHh+uLvyCnZdPo0YXdyEe+ZowQ==

MMGT27gl8VFJ

pLA/Ve3++kcn1lhn6dDmhI2KGzfKNYU=

Ic/vJ/dG0uDhkYblI6XXFL0SN8cDrZP5

MfKDkw/woqFDCabB0YIs

IsDCzc1GuJOGdqX4CgCAPA==

bROVz2hP/wgV9/eGkw4=

cyM+htBboyUeyj0qbuqNTrhX9gJF/6fx

Q+MDF9cCCn8pkyU5y7fmPwYagMMGB7jx

Ve57nDZMRqeXP+V+0IMu

vmJrjeIXWfXWuZbB0YIs

5qVAfUZyi/sC13jZWQ==

Extracted

Family

xloader

Version

3.8

Campaign

od65

Decoy

oMDl7+9m1JtQ+KJ//bSZYk7C

0nQRVuikEsWM9KcRhRk=

VXATJsbZt/OyEi6Z0Y9m9O4=

C8ZitXuEXIk613jZWQ==

4IIRKYI2mygmEr7EUhOuiEZ1ux4c

x3mNjz4y4M20lnKM1I9m9O4=

UGB//3QuqmDHeDQ=

2H5k5/UwHEwPv2G+Sg==

xHh+uLvyCnZdPo0YXdyEe+ZowQ==

MMGT27gl8VFJ

pLA/Ve3++kcn1lhn6dDmhI2KGzfKNYU=

Ic/vJ/dG0uDhkYblI6XXFL0SN8cDrZP5

MfKDkw/woqFDCabB0YIs

IsDCzc1GuJOGdqX4CgCAPA==

bROVz2hP/wgV9/eGkw4=

cyM+htBboyUeyj0qbuqNTrhX9gJF/6fx

Q+MDF9cCCn8pkyU5y7fmPwYagMMGB7jx

Ve57nDZMRqeXP+V+0IMu

vmJrjeIXWfXWuZbB0YIs

5qVAfUZyi/sC13jZWQ==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Users\Admin\AppData\Local\Temp\492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe
      "C:\Users\Admin\AppData\Local\Temp\492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\SysWOW64\iexpress.exe
        "C:\Windows\System32\iexpress.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3408
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\SysWOW64\netsh.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:4556

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    2
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/432-999-0x0000000000900000-0x000000000092D000-memory.dmp
      Filesize

      180KB

    • memory/432-966-0x0000000000000000-mapping.dmp
    • memory/432-984-0x0000000000E80000-0x0000000000E9E000-memory.dmp
      Filesize

      120KB

    • memory/432-985-0x00000000032D0000-0x00000000035F0000-memory.dmp
      Filesize

      3.1MB

    • memory/432-986-0x0000000000900000-0x000000000092D000-memory.dmp
      Filesize

      180KB

    • memory/432-994-0x0000000002EA0000-0x0000000002F2F000-memory.dmp
      Filesize

      572KB

    • memory/2108-1064-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-995-0x0000000003350000-0x000000000343E000-memory.dmp
      Filesize

      952KB

    • memory/2108-1063-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-1062-0x0000000001530000-0x0000000001540000-memory.dmp
      Filesize

      64KB

    • memory/2108-1061-0x00000000014E0000-0x00000000014F0000-memory.dmp
      Filesize

      64KB

    • memory/2108-1000-0x0000000003350000-0x000000000343E000-memory.dmp
      Filesize

      952KB

    • memory/2108-1065-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-998-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-997-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-996-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-1066-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-930-0x0000000001560000-0x0000000001622000-memory.dmp
      Filesize

      776KB

    • memory/2108-1067-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-1068-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-1069-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-1070-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-965-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-964-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-963-0x0000000002E20000-0x0000000002E30000-memory.dmp
      Filesize

      64KB

    • memory/2108-962-0x0000000001630000-0x0000000001640000-memory.dmp
      Filesize

      64KB

    • memory/2108-961-0x0000000001530000-0x0000000001540000-memory.dmp
      Filesize

      64KB

    • memory/2108-960-0x00000000014E0000-0x00000000014F0000-memory.dmp
      Filesize

      64KB

    • memory/2744-144-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-183-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-150-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-151-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-152-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-153-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-154-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-156-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-155-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-157-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-158-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-159-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-160-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-161-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-162-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-163-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-164-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-165-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-166-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-167-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-168-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-169-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-171-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-170-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-172-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-173-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-174-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-175-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-176-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-177-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-178-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-179-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-180-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-182-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-181-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-149-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-121-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-122-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-123-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-124-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-125-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-148-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-147-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-146-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-145-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-120-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-143-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-142-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-141-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-126-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-127-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-140-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-139-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-138-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-137-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-135-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-136-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-134-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-133-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-132-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-131-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-130-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-129-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/2744-128-0x0000000076F80000-0x000000007710E000-memory.dmp
      Filesize

      1.6MB

    • memory/3408-982-0x0000000010411000-0x000000001043F000-memory.dmp
      Filesize

      184KB

    • memory/3408-981-0x0000000010410000-0x000000001043F000-memory.dmp
      Filesize

      188KB

    • memory/3408-929-0x0000000003030000-0x000000000317A000-memory.dmp
      Filesize

      1.3MB

    • memory/3408-927-0x0000000004DB0000-0x00000000050D0000-memory.dmp
      Filesize

      3.1MB

    • memory/3408-926-0x0000000010411000-0x000000001043F000-memory.dmp
      Filesize

      184KB

    • memory/3408-925-0x0000000010410000-0x000000001043F000-memory.dmp
      Filesize

      188KB

    • memory/3408-797-0x0000000000000000-mapping.dmp