General

  • Target

    RFQ 97571784.exe

  • Size

    599KB

  • Sample

    221003-hsnvdsdhcn

  • MD5

    c74c07398f92eaca8cc4e773796d6497

  • SHA1

    cb61c996bb0b7b9fbb4e4baece2fa6e142436ee5

  • SHA256

    5eacddfba11e9ce3946802e55e8abb159eb51a3bd27c7a92a68b8b23dcee79c8

  • SHA512

    0aa0ac665bab40ee96d99ba2f38c329e9d707688ccb8f07e04728e88eb2aaf37d1d65eaab06ff43de1d616261a1ac10428630b16c2cabf2b232156d5cdfdda11

Malware Config

Extracted

Family

formbook

Campaign

hzb3

Decoy

BVGWUXYpaaEaNSjsCHhJnDJz463cqQ==

CEqdZb0KaOLLbWqrDVTgc20=

nBv0jSFiQHxtE6awQnm2

E1sGpCJYtB8ImaguUyF6yQ==

PMBND7LzJGZH7CXulclbs2c=

u9zzlFGDXo6LLbGwQnm2

SaJjLbtVlMgsP5ZQRj4=

wckwEbwBbKA2X3g=

rPxB8ePUxfu4pilu

S562QFeKY5P//qawQnm2

BkEfWXZuY3ihKW8=

ZanakqMxkP7VdNfWdD4FGDqF

PYYbtzdINC1J0OYzQCk=

Fmg9LBxaPQ==

4eXWfoC06yGAkQ0l+Txs2w==

n68j2X6+CIhsD5GiCMYBsHI=

hRv6hpW3qfLbdI1XJ/J825G1TslJ+1JE

X6PAVGfwPHihKW8=

7zn1tkuDaZ2FKbGwQnm2

lB0m5ghWsSmMpIUS8EBM31l/463cqQ==

Extracted

Family

xloader

Version

3.8

Campaign

hzb3

Decoy

BVGWUXYpaaEaNSjsCHhJnDJz463cqQ==

CEqdZb0KaOLLbWqrDVTgc20=

nBv0jSFiQHxtE6awQnm2

E1sGpCJYtB8ImaguUyF6yQ==

PMBND7LzJGZH7CXulclbs2c=

u9zzlFGDXo6LLbGwQnm2

SaJjLbtVlMgsP5ZQRj4=

wckwEbwBbKA2X3g=

rPxB8ePUxfu4pilu

S562QFeKY5P//qawQnm2

BkEfWXZuY3ihKW8=

ZanakqMxkP7VdNfWdD4FGDqF

PYYbtzdINC1J0OYzQCk=

Fmg9LBxaPQ==

4eXWfoC06yGAkQ0l+Txs2w==

n68j2X6+CIhsD5GiCMYBsHI=

hRv6hpW3qfLbdI1XJ/J825G1TslJ+1JE

X6PAVGfwPHihKW8=

7zn1tkuDaZ2FKbGwQnm2

lB0m5ghWsSmMpIUS8EBM31l/463cqQ==

Targets

    • Target

      RFQ 97571784.exe

    • Size

      599KB

    • MD5

      c74c07398f92eaca8cc4e773796d6497

    • SHA1

      cb61c996bb0b7b9fbb4e4baece2fa6e142436ee5

    • SHA256

      5eacddfba11e9ce3946802e55e8abb159eb51a3bd27c7a92a68b8b23dcee79c8

    • SHA512

      0aa0ac665bab40ee96d99ba2f38c329e9d707688ccb8f07e04728e88eb2aaf37d1d65eaab06ff43de1d616261a1ac10428630b16c2cabf2b232156d5cdfdda11

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                    Privilege Escalation