Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2022 14:12

General

  • Target

    tmp.exe

  • Size

    293KB

  • MD5

    960b0f8219762d17f6f47ee76275c7c1

  • SHA1

    ed0eaa1b2d7636d74713c86548842cdb72b8c8cd

  • SHA256

    b47cf0eaed7e3798e77eaf01aac5783f2c03f7db7802a5215523d4ccdc631bc5

  • SHA512

    06d9751f85266c92e666400dc911271e3354ca550a12a6e45386f46f23c56e02986d8a763f394ecbe470952379a752cb0ab26dee5dcc8d4cab84d28e34104ccc

  • SSDEEP

    6144:eqJT5/+TVlkf7jWDUaLOjYmCVdKrLVi2D9y4CUFHHv:e61+BIjbaafCi/Vi2D9yJU1

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

zgtb

Decoy

gabriellep.com

honghe4.xyz

anisaofrendas.com

happy-tile.com

thesulkies.com

international-ipo.com

tazeco.info

hhhzzz.xyz

vrmonster.xyz

theearthresidencia.com

sportape.xyz

elshadaibaterias.com

koredeiihibi.com

taxtaa.com

globalcityb.com

fxivcama.com

dagsmith.com

elmar-bhp.com

peakice.net

jhcdjewelry.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload ⋅ 4 IoCs
  • Adds policy Run key to start application ⋅ 2 TTPs 2 IoCs
  • Executes dropped EXE ⋅ 1 IoCs
  • Drops startup file ⋅ 2 IoCs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext ⋅ 3 IoCs
  • Drops file in Program Files directory ⋅ 4 IoCs
  • Gathers network information ⋅ 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings ⋅ 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 7 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 12 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Drops file in Program Files directory
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\tmp.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%'
        Drops startup file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:216
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        PID:2156
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      Adds policy Run key to start application
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Gathers network information
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3788
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        PID:3636
      • C:\Windows\SysWOW64\cmd.exe
        /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
        PID:2464
      • C:\Windows\SysWOW64\cmd.exe
        /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
        PID:3292
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        PID:3692
    • C:\Program Files (x86)\Znzu\mhxpofjd4d6v.exe
      "C:\Program Files (x86)\Znzu\mhxpofjd4d6v.exe"
      Executes dropped EXE
      PID:2036

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

    Exfiltration

      Impact

        Initial Access

          Lateral Movement

            Privilege Escalation

              Replay Monitor

              00:00 00:00

              Downloads

              • C:\Program Files (x86)\Znzu\mhxpofjd4d6v.exe
                MD5

                fda8c8f2a4e100afb14c13dfcbcab2d2

                SHA1

                19dfd86294c4a525ba21c6af77681b2a9bbecb55

                SHA256

                99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09

                SHA512

                94f0ace37cae77be9935cf4fc8aaa94691343d3b38de5e16c663b902c220bff513cd02256c7af2d815a23dd30439582ddbb0880009c76bbf36ff8fbc1a6ddc18

              • C:\Program Files (x86)\Znzu\mhxpofjd4d6v.exe
                MD5

                fda8c8f2a4e100afb14c13dfcbcab2d2

                SHA1

                19dfd86294c4a525ba21c6af77681b2a9bbecb55

                SHA256

                99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09

                SHA512

                94f0ace37cae77be9935cf4fc8aaa94691343d3b38de5e16c663b902c220bff513cd02256c7af2d815a23dd30439582ddbb0880009c76bbf36ff8fbc1a6ddc18

              • C:\Users\Admin\AppData\Local\Temp\DB1
                MD5

                b608d407fc15adea97c26936bc6f03f6

                SHA1

                953e7420801c76393902c0d6bb56148947e41571

                SHA256

                b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                SHA512

                cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

              • C:\Users\Admin\AppData\Local\Temp\DB1
                MD5

                349e6eb110e34a08924d92f6b334801d

                SHA1

                bdfb289daff51890cc71697b6322aa4b35ec9169

                SHA256

                c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                SHA512

                2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

              • memory/216-151-0x0000000006120000-0x0000000006142000-memory.dmp
              • memory/216-150-0x00000000060A0000-0x00000000060BA000-memory.dmp
              • memory/216-136-0x00000000022C0000-0x00000000022F6000-memory.dmp
              • memory/216-139-0x0000000004DB0000-0x00000000053D8000-memory.dmp
              • memory/216-140-0x0000000004D10000-0x0000000004D32000-memory.dmp
              • memory/216-142-0x0000000005550000-0x00000000055B6000-memory.dmp
              • memory/216-143-0x00000000055C0000-0x0000000005626000-memory.dmp
              • memory/216-135-0x0000000000000000-mapping.dmp
              • memory/216-149-0x0000000006BC0000-0x0000000006C56000-memory.dmp
              • memory/216-148-0x0000000005BE0000-0x0000000005BFE000-memory.dmp
              • memory/1816-133-0x0000000005780000-0x0000000005D24000-memory.dmp
              • memory/1816-132-0x00000000006E0000-0x0000000000730000-memory.dmp
              • memory/1816-134-0x00000000051D0000-0x000000000526C000-memory.dmp
              • memory/2016-147-0x0000000002890000-0x0000000002981000-memory.dmp
              • memory/2016-158-0x0000000002C00000-0x0000000002CE2000-memory.dmp
              • memory/2016-160-0x0000000002C00000-0x0000000002CE2000-memory.dmp
              • memory/2036-165-0x0000000000000000-mapping.dmp
              • memory/2036-168-0x00000000004E0000-0x00000000004F0000-memory.dmp
              • memory/2036-169-0x0000000005240000-0x000000000576C000-memory.dmp
              • memory/2156-146-0x0000000000EE0000-0x0000000000EF1000-memory.dmp
              • memory/2156-137-0x0000000000000000-mapping.dmp
              • memory/2156-138-0x0000000000400000-0x000000000042B000-memory.dmp
              • memory/2156-144-0x0000000000400000-0x000000000042B000-memory.dmp
              • memory/2156-145-0x00000000013C0000-0x000000000170A000-memory.dmp
              • memory/2464-161-0x0000000000000000-mapping.dmp
              • memory/3292-163-0x0000000000000000-mapping.dmp
              • memory/3636-155-0x0000000000000000-mapping.dmp
              • memory/3788-157-0x0000000001530000-0x00000000015C0000-memory.dmp
              • memory/3788-153-0x0000000000AA0000-0x0000000000AAB000-memory.dmp
              • memory/3788-152-0x0000000000000000-mapping.dmp
              • memory/3788-154-0x0000000000D70000-0x0000000000D9B000-memory.dmp
              • memory/3788-159-0x0000000000D70000-0x0000000000D9B000-memory.dmp
              • memory/3788-156-0x0000000001790000-0x0000000001ADA000-memory.dmp