Overview

overview

10

Static

static

DHL782049 ...df.exe

windows7-x64

10

DHL782049 ...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL782049 receipt document,pdf.exe

  • Size

    647KB

  • Sample

    221010-rszfkacbd7

  • MD5

    4ad00a3edad63b8cac948920408c4d1a

  • SHA1

    802ed070dfeab279cf49bfe83c321674eada7646

  • SHA256

    44a1d009247478459825ba636e930755481a09dba09e0b9ebd69ae9c284739be

  • SHA512

    8dbd77f87dc884c672ff464c5f59e05884f8280c89dd866c4d88745fd708a4b849eabc064a75c4269890526aa1193a909712087685dbf7c55254c5b36aac369c

  • SSDEEP

    6144:QNeZqUSx7vSE2qRG9tnVmTiideDGDNcNB79VeJ+Rj8SZr9nkL/:QNzUSRUtnVqi6xNcNrkiJr9kL/

Score
10/10
formbookxloadernrlnloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

nrln

Decoy

IG7zJSm49UqTTuu/N/oTCIg=

CVLdAPgw0CRSMuZnRRU=

PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG

5i6p4GeQqtBgNRfGNQ==

5984keYswxh8mGZHz4ipAHtQ

VNJaK4Gh0CrOvHpW/p353A==

71rEtrL2icToyKGhcWrTxjsFU5T98zeO

r3q1sy1iZaL+2XIUAob7yw==

9+83Qkrk/vV/jVXsDvoTCIg=

aMFAgYF1prov8/UErH/Y1A==

Alqtx/0rxwEbCLdudftl

ImCbnglBSUHF0mv2tTSP40bPeYao

s4DFNvAJ4GIJ+g==

phOa6mtS8QQICuZnRRU=

7TSu5vqRtB45EZtf4WDSTBHPeYao

ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=

HF7jKjbGox2SAffTPw==

yAM3mOQot5l+cD0ikR5MGp8=

UYzW0/8z70JcQenVLidu1kLPeYao

OoCznp5UWz+hT9OBFXbfVhXPeYao

Extracted

Family

xloader

Version

3.8

Campaign

nrln

Decoy

IG7zJSm49UqTTuu/N/oTCIg=

CVLdAPgw0CRSMuZnRRU=

PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG

5i6p4GeQqtBgNRfGNQ==

5984keYswxh8mGZHz4ipAHtQ

VNJaK4Gh0CrOvHpW/p353A==

71rEtrL2icToyKGhcWrTxjsFU5T98zeO

r3q1sy1iZaL+2XIUAob7yw==

9+83Qkrk/vV/jVXsDvoTCIg=

aMFAgYF1prov8/UErH/Y1A==

Alqtx/0rxwEbCLdudftl

ImCbnglBSUHF0mv2tTSP40bPeYao

s4DFNvAJ4GIJ+g==

phOa6mtS8QQICuZnRRU=

7TSu5vqRtB45EZtf4WDSTBHPeYao

ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=

HF7jKjbGox2SAffTPw==

yAM3mOQot5l+cD0ikR5MGp8=

UYzW0/8z70JcQenVLidu1kLPeYao

OoCznp5UWz+hT9OBFXbfVhXPeYao

Targets

    • Target

      DHL782049 receipt document,pdf.exe

    • Size

      647KB

    • MD5

      4ad00a3edad63b8cac948920408c4d1a

    • SHA1

      802ed070dfeab279cf49bfe83c321674eada7646

    • SHA256

      44a1d009247478459825ba636e930755481a09dba09e0b9ebd69ae9c284739be

    • SHA512

      8dbd77f87dc884c672ff464c5f59e05884f8280c89dd866c4d88745fd708a4b849eabc064a75c4269890526aa1193a909712087685dbf7c55254c5b36aac369c

    • SSDEEP

      6144:QNeZqUSx7vSE2qRG9tnVmTiideDGDNcNB79VeJ+Rj8SZr9nkL/:QNzUSRUtnVqi6xNcNrkiJr9kL/

    Score
    10/10
    formbookxloadernrlnloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks