Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01-10-2022 14:12

General

  • Target

    tmp.exe

  • Size

    293KB

  • MD5

    960b0f8219762d17f6f47ee76275c7c1

  • SHA1

    ed0eaa1b2d7636d74713c86548842cdb72b8c8cd

  • SHA256

    b47cf0eaed7e3798e77eaf01aac5783f2c03f7db7802a5215523d4ccdc631bc5

  • SHA512

    06d9751f85266c92e666400dc911271e3354ca550a12a6e45386f46f23c56e02986d8a763f394ecbe470952379a752cb0ab26dee5dcc8d4cab84d28e34104ccc

  • SSDEEP

    6144:eqJT5/+TVlkf7jWDUaLOjYmCVdKrLVi2D9y4CUFHHv:e61+BIjbaafCi/Vi2D9yJU1

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

zgtb

Decoy

gabriellep.com

honghe4.xyz

anisaofrendas.com

happy-tile.com

thesulkies.com

international-ipo.com

tazeco.info

hhhzzz.xyz

vrmonster.xyz

theearthresidencia.com

sportape.xyz

elshadaibaterias.com

koredeiihibi.com

taxtaa.com

globalcityb.com

fxivcama.com

dagsmith.com

elmar-bhp.com

peakice.net

jhcdjewelry.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload ⋅ 5 IoCs
  • Adds policy Run key to start application ⋅ 2 TTPs 2 IoCs
  • Drops startup file ⋅ 2 IoCs
  • Suspicious use of SetThreadContext ⋅ 3 IoCs
  • Drops file in Program Files directory ⋅ 1 IoCs
  • Modifies Internet Explorer settings ⋅ 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 21 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 7 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 4 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 2 IoCs
  • Suspicious use of SendNotifyMessage ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 24 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1300
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\tmp.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%'
        Drops startup file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:1312
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        PID:736
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\SysWOW64\mstsc.exe"
      Adds policy Run key to start application
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:972
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        PID:1800
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        PID:1760

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • memory/736-63-0x0000000000400000-0x000000000042B000-memory.dmp
                      • memory/736-68-0x0000000000450000-0x0000000000461000-memory.dmp
                      • memory/736-67-0x0000000000700000-0x0000000000A03000-memory.dmp
                      • memory/736-66-0x0000000000400000-0x000000000042B000-memory.dmp
                      • memory/736-64-0x000000000041F1F0-mapping.dmp
                      • memory/736-60-0x0000000000400000-0x000000000042B000-memory.dmp
                      • memory/736-61-0x0000000000400000-0x000000000042B000-memory.dmp
                      • memory/972-76-0x0000000000080000-0x00000000000AB000-memory.dmp
                      • memory/972-71-0x0000000000000000-mapping.dmp
                      • memory/972-80-0x0000000000080000-0x00000000000AB000-memory.dmp
                      • memory/972-78-0x0000000000970000-0x0000000000A00000-memory.dmp
                      • memory/972-77-0x0000000002120000-0x0000000002423000-memory.dmp
                      • memory/972-75-0x0000000000A80000-0x0000000000B84000-memory.dmp
                      • memory/1188-79-0x00000000042A0000-0x000000000433B000-memory.dmp
                      • memory/1188-69-0x0000000004010000-0x00000000040C8000-memory.dmp
                      • memory/1188-81-0x00000000042A0000-0x000000000433B000-memory.dmp
                      • memory/1300-54-0x0000000000850000-0x00000000008A0000-memory.dmp
                      • memory/1300-55-0x0000000000320000-0x0000000000366000-memory.dmp
                      • memory/1300-56-0x0000000074F41000-0x0000000074F43000-memory.dmp
                      • memory/1300-58-0x00000000004E0000-0x00000000004FC000-memory.dmp
                      • memory/1312-70-0x00000000744F0000-0x0000000074A9B000-memory.dmp
                      • memory/1312-73-0x00000000744F0000-0x0000000074A9B000-memory.dmp
                      • memory/1312-57-0x0000000000000000-mapping.dmp
                      • memory/1800-74-0x0000000000000000-mapping.dmp