Analysis
-
max time kernel
210s -
max time network
211s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
21-09-2022 10:46
General
-
Target
太太希Jw的 rA.exe
-
Size
499KB
-
MD5
73aac8ac5dc4ded42398f9fe2a191c19
-
SHA1
4f3ed7fa592f4ae4c4462928543dcbd4997f2549
-
SHA256
6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5
-
SHA512
cc5459746e50fe49d87f5facbb7ee79c1554697e54df2a615ace177ef0f439d134f188e19f51a1f866486237d3a79fa381d362b7da942dc74e00f675bc3cb58d
-
SSDEEP
12288:0osBGYb7Hku+M1e02kE15gLXOCYeHcUiK9DRB1R5//+P25wENJYWfaBFyutY4ld2:cBGO7HkwGkE15AXOCYeHcU7
Score
10/10
Malware Config
Extracted
Family
formbook
Campaign
v4qp
Decoy
je1XQKU1LfJPVLk=
nvf41a7FsTLs6uB/g+CR
U7mryF6DctZn6GEjr9Bm4g==
1SONGrPdh7wGEOXp3g==
2xX859r7qOFq7GYkr9Bm4g==
IYtzVUx0Oo0HmZawLQAARDvBf4dL
NH3iuBPNSzZTvpw/4KaG
rDehfiqIPbdMBS8G1g==
xhb2uJ0eBwo7k3djqxh60xoNt4VoeQ==
AFtKux3JgPGRkx3xUsciR6piSg==
m+3VoJadWcBvOAPpzKUNPoAxyplS
1DWKULdka3mxIKhEqGxQr7gxyplS
DGlFGBqWi5CtrCX9alyTuPzq
muvVM4slyTfxORwAZisVksCM78aSEVo=
D3biNgUbyg9E5pl+
/+1QLPssvl/Xxg==
I4lzTjaAcc1iBS8G1g==
wSwc4MmbShojhlZCrniTuPzq
jN5YO6ZXSfJPVLk=
4TUS4+ANuqHCRTM9sniTuPzq
Extracted
Family
xloader
Version
2.9
Campaign
v4qp
Decoy
je1XQKU1LfJPVLk=
nvf41a7FsTLs6uB/g+CR
U7mryF6DctZn6GEjr9Bm4g==
1SONGrPdh7wGEOXp3g==
2xX859r7qOFq7GYkr9Bm4g==
IYtzVUx0Oo0HmZawLQAARDvBf4dL
NH3iuBPNSzZTvpw/4KaG
rDehfiqIPbdMBS8G1g==
xhb2uJ0eBwo7k3djqxh60xoNt4VoeQ==
AFtKux3JgPGRkx3xUsciR6piSg==
m+3VoJadWcBvOAPpzKUNPoAxyplS
1DWKULdka3mxIKhEqGxQr7gxyplS
DGlFGBqWi5CtrCX9alyTuPzq
muvVM4slyTfxORwAZisVksCM78aSEVo=
D3biNgUbyg9E5pl+
/+1QLPssvl/Xxg==
I4lzTjaAcc1iBS8G1g==
wSwc4MmbShojhlZCrniTuPzq
jN5YO6ZXSfJPVLk=
4TUS4+ANuqHCRTM9sniTuPzq
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload 14 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 29 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"5⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"6⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"6⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"7⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"12⤵
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/364-55-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/364-74-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/524-125-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/524-122-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/524-113-0x0000000000000000-mapping.dmp
-
memory/632-91-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/632-89-0x000000000041F6E0-mapping.dmp
-
memory/952-121-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/952-120-0x000000000041F6E0-mapping.dmp
-
memory/1076-111-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1076-110-0x000000000041F6E0-mapping.dmp
-
memory/1112-151-0x000000000041F6E0-mapping.dmp
-
memory/1112-152-0x0000000000880000-0x0000000000B83000-memory.dmpFilesize
3.0MB
-
memory/1120-79-0x000000000041F6E0-mapping.dmp
-
memory/1120-80-0x0000000000980000-0x0000000000C83000-memory.dmpFilesize
3.0MB
-
memory/1288-102-0x0000000000430000-0x00000000004C0000-memory.dmpFilesize
576KB
-
memory/1288-70-0x00000000000C0000-0x00000000000EC000-memory.dmpFilesize
176KB
-
memory/1288-71-0x0000000000BB0000-0x0000000000EB3000-memory.dmpFilesize
3.0MB
-
memory/1288-124-0x00000000000C0000-0x00000000000EC000-memory.dmpFilesize
176KB
-
memory/1288-69-0x0000000000F60000-0x0000000000F78000-memory.dmpFilesize
96KB
-
memory/1288-65-0x0000000000000000-mapping.dmp
-
memory/1332-81-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1332-83-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1332-72-0x0000000000000000-mapping.dmp
-
memory/1356-64-0x0000000003E80000-0x0000000003F5A000-memory.dmpFilesize
872KB
-
memory/1356-166-0x0000000005EE0000-0x0000000006065000-memory.dmpFilesize
1.5MB
-
memory/1356-170-0x0000000005EE0000-0x0000000006065000-memory.dmpFilesize
1.5MB
-
memory/1376-68-0x0000000000000000-mapping.dmp
-
memory/1396-99-0x000000000041F6E0-mapping.dmp
-
memory/1396-100-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/1436-115-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1436-103-0x0000000000000000-mapping.dmp
-
memory/1436-112-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1584-136-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1584-123-0x0000000000000000-mapping.dmp
-
memory/1584-133-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1616-92-0x0000000000000000-mapping.dmp
-
memory/1616-105-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1616-101-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1620-143-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/1620-142-0x000000000041F6E0-mapping.dmp
-
memory/1640-154-0x0000000000000000-mapping.dmp
-
memory/1640-169-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1640-157-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1708-60-0x000000000041F6E0-mapping.dmp
-
memory/1708-57-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1708-66-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1708-63-0x0000000000160000-0x0000000000171000-memory.dmpFilesize
68KB
-
memory/1708-56-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1708-59-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1708-61-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/1724-163-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/1724-162-0x000000000041F6E0-mapping.dmp
-
memory/1764-94-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1764-82-0x0000000000000000-mapping.dmp
-
memory/1764-90-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1800-144-0x0000000000000000-mapping.dmp
-
memory/1800-153-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1800-156-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1868-131-0x000000000041F6E0-mapping.dmp
-
memory/1868-132-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/1928-134-0x0000000000000000-mapping.dmp
-
memory/1928-146-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1928-137-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/2012-164-0x0000000000000000-mapping.dmp
-
memory/2012-167-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/2012-168-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB