General

  • Target

    Purchase_Order.cab

  • Size

    254KB

  • Sample

    220928-qk384shagj

  • MD5

    47cfaa5c668b0794d6e9f1a4b594beab

  • SHA1

    c76524f44100a824d0f914926792aaae02a81e20

  • SHA256

    581238515a92e54b096629b7bb9777bd1f703dc8df9a1ba7c94a79c20ec75cb0

  • SHA512

    bbf3cfd12ced37b1fcf3029fe41fa2ac920b062fb9236d127254e16ef5da42a7babba9ed6bc665f9bbf1979c68463356ab456ca2321572b15442e0b3ffac722c

  • SSDEEP

    6144:lSX52lwaA2NMvc6R5VwWWKHNLYlA8yjXeIImlssGEK/UQECocEQi6MZjOj:lST2NMvXBWKtL0uhIWGEK/GCozZ6MJOj

Malware Config

Extracted

Family

formbook

Campaign

i65a

Decoy

r00zzvD9uoqMkFT8XDSqPg==

iSMQDJ3Tyuj8KXflBw==

Gq+tYoFrGU/5B4gGNnzHNg==

wEwcynSwpynZKUFhqyIK

bw3PbrjowhAVJA==

TggEt9LuwhAVJA==

r0UqC6sxgcWN7vc=

0m+fwBgf0oyehByUtx51BsBkuj8=

dhtdWWyIhRatp2dpv8tPcJoQ

jTAw4/4TCwcXjpECXDSqPg==

aglx4nPPkGp/raeivGVOfzdbFIu4

+qXr4cAGtQJm7Mf6

sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=

E6ohOo2zadVgzLIfaWALaik=

wXwu0yo/KbNm7Mf6

EcoyojCJYKg1laCuBK+exkNbFIu4

bhZgFvj6yP+R4F+0/5S/oFMpAA==

rzlylCB1NIMabG2dzGQd

+5ngCKjwwhAVJA==

AMUtZrYh+0LPL/QyfSo=

Extracted

Family

xloader

Version

3.8

Campaign

i65a

Decoy

r00zzvD9uoqMkFT8XDSqPg==

iSMQDJ3Tyuj8KXflBw==

Gq+tYoFrGU/5B4gGNnzHNg==

wEwcynSwpynZKUFhqyIK

bw3PbrjowhAVJA==

TggEt9LuwhAVJA==

r0UqC6sxgcWN7vc=

0m+fwBgf0oyehByUtx51BsBkuj8=

dhtdWWyIhRatp2dpv8tPcJoQ

jTAw4/4TCwcXjpECXDSqPg==

aglx4nPPkGp/raeivGVOfzdbFIu4

+qXr4cAGtQJm7Mf6

sU2Dc4ySSKZJc2/L32pFRrq+NgA0Yi8=

E6ohOo2zadVgzLIfaWALaik=

wXwu0yo/KbNm7Mf6

EcoyojCJYKg1laCuBK+exkNbFIu4

bhZgFvj6yP+R4F+0/5S/oFMpAA==

rzlylCB1NIMabG2dzGQd

+5ngCKjwwhAVJA==

AMUtZrYh+0LPL/QyfSo=

Targets

    • Target

      Purchase_Order.exe

    • Size

      295KB

    • MD5

      4e256d3d4ddbcc9c1d2cfa57034a0d52

    • SHA1

      60ec184a1ab03af29341f093791e210202814f1c

    • SHA256

      5463db9a5e180df75642646615cfd6ff7598b9846718c2224f19c878ee01dc00

    • SHA512

      2e455bd66870778fc511515d3db4ae3b14d16374436cc4f6b70c182b42f2c70f977b9976194c1fb392f0ab28ebc4b7fd3ecec87fba279a541c6be396425fd79e

    • SSDEEP

      6144:uj5zFdfKy5i+xc+tR5VwWmKH0LYlA8yjXeIIzls3GEioll+8zE7ev:efKy5p9tBmKUL0uhIoGEiQltEi

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks