Overview

overview

10

Static

static

SOCHIDEXPO...XE.exe

windows7-x64

10

SOCHIDEXPO...XE.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2022, 10:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SOCHIDEXPO_PDF.EXE.exe
  • Size 302KB
  • Sample221010-mpymmsbeb5
  • SHA256 5ef60b3981c6f69e4dc216f6dc71c4f43a918b625f6a3d9bfbce2067016ddfa7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookxloaderi3twloaderratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • i3tw

Decoy

  • 016XYOaa546POq6CaRVpEfQ=

  • 6WCLUcRz6K7qTqIK

  • bIa/9uWTepQa6eQd

  • 32urdxWXgrknUIeDYktb

  • EojfLVA0GyB2mYgMgzdT

  • jFbHYJhPwpebnHjAY0pZ

  • gxSusEwA30uVtrErCrQ=

  • EeJOmOn63OaCHIw=

  • r3K0jTvKtOR4EV3q1dOdHgYVCLVG

  • 6LEakplWzoSSLXZH3t6XDQ==

  • MThmlLavncxvAo1f3t6XDQ==

  • SqUmLs+BeJfa69kp7qSmIfuU5K3ZMg==

  • GuIYfF0o7zGPJY4=

  • AEd4Wd7JRsdzBX9dPgO7KNJY6NX2Sga4

  • E1SDU8MxGoZaPFgn9w==

  • cIq96QyWC/k1XDBRTR9FQOaLosd4Og==

  • /zRZMuaxmZnX291wZQCXhiq1his=

  • +47IMmwvk2jyx7MA

  • IGKz6DH4iraNLQ==

  • Kh1gHpxbw0MDkwSyaOqjKgTlK69R

Extracted

Family

  • xloader

Version

  • 3.8

Campaign

  • i3tw

Decoy

  • 016XYOaa546POq6CaRVpEfQ=

  • 6WCLUcRz6K7qTqIK

  • bIa/9uWTepQa6eQd

  • 32urdxWXgrknUIeDYktb

  • EojfLVA0GyB2mYgMgzdT

  • jFbHYJhPwpebnHjAY0pZ

  • gxSusEwA30uVtrErCrQ=

  • EeJOmOn63OaCHIw=

  • r3K0jTvKtOR4EV3q1dOdHgYVCLVG

  • 6LEakplWzoSSLXZH3t6XDQ==

  • MThmlLavncxvAo1f3t6XDQ==

  • SqUmLs+BeJfa69kp7qSmIfuU5K3ZMg==

  • GuIYfF0o7zGPJY4=

  • AEd4Wd7JRsdzBX9dPgO7KNJY6NX2Sga4

  • E1SDU8MxGoZaPFgn9w==

  • cIq96QyWC/k1XDBRTR9FQOaLosd4Og==

  • /zRZMuaxmZnX291wZQCXhiq1his=

  • +47IMmwvk2jyx7MA

  • IGKz6DH4iraNLQ==

  • Kh1gHpxbw0MDkwSyaOqjKgTlK69R

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Users\Admin\AppData\Local\Temp\SOCHIDEXPO_PDF.EXE.exe
      "C:\Users\Admin\AppData\Local\Temp\SOCHIDEXPO_PDF.EXE.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Users\Admin\AppData\Local\Temp\egpsroovgo.exe
        "C:\Users\Admin\AppData\Local\Temp\egpsroovgo.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Users\Admin\AppData\Local\Temp\egpsroovgo.exe
          "C:\Users\Admin\AppData\Local\Temp\egpsroovgo.exe"
          4⤵
          • Checks computer location settings
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1380
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1732
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1320

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          egpsroovgo.exe
          • Path C:\Users\Admin\AppData\Local\Temp\egpsroovgo.exe
          • Size 123KB
          • SHA256 9c3c8d8694f2930955df11cf0485759035c6a87e5888939bca7e22dab252db0b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          egpsroovgo.exe
          • Path C:\Users\Admin\AppData\Local\Temp\egpsroovgo.exe
          • Size 123KB
          • SHA256 9c3c8d8694f2930955df11cf0485759035c6a87e5888939bca7e22dab252db0b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          egpsroovgo.exe
          • Path C:\Users\Admin\AppData\Local\Temp\egpsroovgo.exe
          • Size 123KB
          • SHA256 9c3c8d8694f2930955df11cf0485759035c6a87e5888939bca7e22dab252db0b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          keslfoboj.pac
          • Path C:\Users\Admin\AppData\Local\Temp\keslfoboj.pac
          • Size 185KB
          • SHA256 588e3e2e912751b01111345b0904df60c198caa0959effa1f2ee9cd486328e16
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          mnihp.q
          • Path C:\Users\Admin\AppData\Local\Temp\mnihp.q
          • Size 4KB
          • SHA256 5ed5ea2b0d0a9afd6342eaa017a459d1e7f4d576bc6bfe11996b9ce59ea6a880
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          egpsroovgo.exe
          • Path \Users\Admin\AppData\Local\Temp\egpsroovgo.exe
          • Size 123KB
          • SHA256 9c3c8d8694f2930955df11cf0485759035c6a87e5888939bca7e22dab252db0b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          egpsroovgo.exe
          • Path \Users\Admin\AppData\Local\Temp\egpsroovgo.exe
          • Size 123KB
          • SHA256 9c3c8d8694f2930955df11cf0485759035c6a87e5888939bca7e22dab252db0b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sqlite3.dll
          • Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
          • Size 770KB
          • SHA256 32a302d8c235226d8cdda4d957f151df3e5736fdce7886e6c794f0648b2eb106
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1288-68-0x00000000064D0000-0x0000000006653000-memory.dmp
          Download

          memory/1288-77-0x0000000004040000-0x000000000416B000-memory.dmp
          Download

          memory/1288-74-0x0000000004040000-0x000000000416B000-memory.dmp
          Download

          memory/1380-65-0x0000000000400000-0x000000000042F000-memory.dmp
          Download

          memory/1380-67-0x00000000001E0000-0x00000000001F0000-memory.dmp
          Download

          memory/1380-66-0x0000000000860000-0x0000000000B63000-memory.dmp
          Download

          memory/1732-71-0x0000000000080000-0x00000000000AD000-memory.dmp
          Download

          memory/1732-70-0x00000000000B0000-0x00000000000C6000-memory.dmp
          Download

          memory/1732-72-0x0000000001E60000-0x0000000002163000-memory.dmp
          Download

          memory/1732-73-0x0000000001DA0000-0x0000000001E2F000-memory.dmp
          Download

          memory/1732-75-0x0000000000080000-0x00000000000AD000-memory.dmp
          Download

          memory/1944-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp
          Download