Analysis

  • max time kernel
    236s
  • max time network
    250s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2022 04:30

General

  • Target

    4c974d9519a2bfe890a2fd763224d1e7.exe

  • Size

    333KB

  • MD5

    4c974d9519a2bfe890a2fd763224d1e7

  • SHA1

    2e88feb98658d7ffee549438453aef2bc162b115

  • SHA256

    1ade1d842f0cb779839799c419832a9c05238f94a678e7cbf44fae51e2264f71

  • SHA512

    fbfccf98cf6cd86715c7990c31c1a3865ea5833f471cb198bf0bf523583e540f25b285022cecb40d97a93b230b5c89f566699f3c70382af03d13327854da5b27

  • SSDEEP

    6144:9kw4zSWT5nfPUV3IyLOCJ8a2e8/rBpAUfoyrlAtn/3lxS5qr:k38RIyLG88TBawZi/3lkO

Malware Config

Extracted

Family

formbook

Campaign

dwdp

Decoy

jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=

ke1Wv1l26dZZxDikX9dU3s6k8+w=

+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==

GHXPhYzwXcKgZwqBb/kejm7rfobj

yalW64iE8+aXs70=

MD83dBR0KSF4fizgRhAM

Xti3uNm2JDWgssPgRhAM

X7gYbv5uJhpvjdI0Qg==

ydxGznbNJ3tCCLAX4arq4nweMuQ=

Ca+fvtST8OBbosPgRhAM

kG1QegD8mU/E/hLw1t0=

g9FFFjEC5C2IvR/BhbSrpw==

PCkpeg38W0aPdg1rav1DFnVASw==

vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7

G7WYirSZS9EYob8=

WbEWaOVIAPlSNNc4LsfL53weMuQ=

hnyAvEY4n3rTKS4g5mHKxR0=

JN7b0uCqVrQydMl7JNw=

XTki/RASDK6BCW0q8sU=

DQMBWA9wJyOKqqGSmGHKxR0=

Extracted

Family

xloader

Version

3.8

Campaign

dwdp

Decoy

jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=

ke1Wv1l26dZZxDikX9dU3s6k8+w=

+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==

GHXPhYzwXcKgZwqBb/kejm7rfobj

yalW64iE8+aXs70=

MD83dBR0KSF4fizgRhAM

Xti3uNm2JDWgssPgRhAM

X7gYbv5uJhpvjdI0Qg==

ydxGznbNJ3tCCLAX4arq4nweMuQ=

Ca+fvtST8OBbosPgRhAM

kG1QegD8mU/E/hLw1t0=

g9FFFjEC5C2IvR/BhbSrpw==

PCkpeg38W0aPdg1rav1DFnVASw==

vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7

G7WYirSZS9EYob8=

WbEWaOVIAPlSNNc4LsfL53weMuQ=

hnyAvEY4n3rTKS4g5mHKxR0=

JN7b0uCqVrQydMl7JNw=

XTki/RASDK6BCW0q8sU=

DQMBWA9wJyOKqqGSmGHKxR0=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Users\Admin\AppData\Local\Temp\4c974d9519a2bfe890a2fd763224d1e7.exe
      "C:\Users\Admin\AppData\Local\Temp\4c974d9519a2bfe890a2fd763224d1e7.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2624
      • C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exe
        "C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exe" C:\Users\Admin\AppData\Local\Temp\qwdscgke.dnn
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:5044
        • C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exe
          "C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4568
          • C:\Windows\SysWOW64\msiexec.exe
            "C:\Windows\SysWOW64\msiexec.exe"
            5⤵
            • Suspicious use of SetThreadContext
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1152
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              6⤵
                PID:2264
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:4376
        • C:\Windows\SysWOW64\autoconv.exe
          "C:\Windows\SysWOW64\autoconv.exe"
          2⤵
            PID:4600
          • C:\Windows\SysWOW64\autoconv.exe
            "C:\Windows\SysWOW64\autoconv.exe"
            2⤵
              PID:440
            • C:\Windows\SysWOW64\autoconv.exe
              "C:\Windows\SysWOW64\autoconv.exe"
              2⤵
                PID:3308
              • C:\Windows\SysWOW64\raserver.exe
                "C:\Windows\SysWOW64\raserver.exe"
                2⤵
                  PID:2656

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              Registry Run Keys / Startup Folder

              1
              T1060

              Defense Evasion

              Modify Registry

              2
              T1112

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              2
              T1082

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\fugegefct.s
                Filesize

                185KB

                MD5

                2375912c75db13281f3bfc9c3ddf7646

                SHA1

                9955467017fcb057d1ca868db84f4f7ebc31fd45

                SHA256

                f9cdfa1edf4a5f85d8ddaae338fc550580ff5094eed1507c9beca4097298d861

                SHA512

                56242ec311c00540ebee80b661fb3fcf8674635d48675b17e1de677271ab997f3ae057f009cf34654b5241b11e1a3f0d97f8f99be4e78a4b32b519a7695e5256

              • C:\Users\Admin\AppData\Local\Temp\qwdscgke.dnn
                Filesize

                7KB

                MD5

                2c406815d04080e2fa43ba9e99ceabd3

                SHA1

                27b0f2b81e15d7715867accb5fa68f8c8f4ea209

                SHA256

                b70fa69ab56821b4902e9922d786948c5673440e0f8dd5403385d96d0167cee4

                SHA512

                32df91288abf935fb71e1fa04beeed0d945877f2ed2830fd7068344523371a05bc5fe973f475e8a1f9b5d95f50ca4ae9ab75a5182a063476209f2cb22b6c9b89

              • C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exe
                Filesize

                276KB

                MD5

                bd4eb7604f815c32830ec68cc479ad62

                SHA1

                00ac1b0b12be758027c01083ad85604305d4b1af

                SHA256

                1b417034908720dffd6e5847b89a013f0414b46a31f2e93f91446f8efede1f64

                SHA512

                b72e5e0e8cce7a22b6053f6daed91e91bc7c81c7a314a8340aa2903d1506b4e04e91ed2d08f343f9a616ecbf3f83cbe4763ee0876dd61e2acab141adc8d4dcd9

              • C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exe
                Filesize

                276KB

                MD5

                bd4eb7604f815c32830ec68cc479ad62

                SHA1

                00ac1b0b12be758027c01083ad85604305d4b1af

                SHA256

                1b417034908720dffd6e5847b89a013f0414b46a31f2e93f91446f8efede1f64

                SHA512

                b72e5e0e8cce7a22b6053f6daed91e91bc7c81c7a314a8340aa2903d1506b4e04e91ed2d08f343f9a616ecbf3f83cbe4763ee0876dd61e2acab141adc8d4dcd9

              • C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exe
                Filesize

                276KB

                MD5

                bd4eb7604f815c32830ec68cc479ad62

                SHA1

                00ac1b0b12be758027c01083ad85604305d4b1af

                SHA256

                1b417034908720dffd6e5847b89a013f0414b46a31f2e93f91446f8efede1f64

                SHA512

                b72e5e0e8cce7a22b6053f6daed91e91bc7c81c7a314a8340aa2903d1506b4e04e91ed2d08f343f9a616ecbf3f83cbe4763ee0876dd61e2acab141adc8d4dcd9

              • memory/1152-147-0x0000000000000000-mapping.dmp
              • memory/1152-153-0x0000000000110000-0x000000000013D000-memory.dmp
                Filesize

                180KB

              • memory/1152-151-0x00000000006D0000-0x000000000075F000-memory.dmp
                Filesize

                572KB

              • memory/1152-150-0x00000000024D0000-0x000000000281A000-memory.dmp
                Filesize

                3.3MB

              • memory/1152-148-0x00000000006B0000-0x00000000006C2000-memory.dmp
                Filesize

                72KB

              • memory/1152-149-0x0000000000110000-0x000000000013D000-memory.dmp
                Filesize

                180KB

              • memory/2476-154-0x0000000002620000-0x00000000026FA000-memory.dmp
                Filesize

                872KB

              • memory/2476-152-0x0000000002620000-0x00000000026FA000-memory.dmp
                Filesize

                872KB

              • memory/2476-143-0x0000000007DA0000-0x0000000007ED7000-memory.dmp
                Filesize

                1.2MB

              • memory/2476-145-0x0000000007EE0000-0x000000000806F000-memory.dmp
                Filesize

                1.6MB

              • memory/4568-137-0x0000000000000000-mapping.dmp
              • memory/4568-146-0x0000000000400000-0x000000000042F000-memory.dmp
                Filesize

                188KB

              • memory/4568-144-0x0000000000610000-0x0000000000620000-memory.dmp
                Filesize

                64KB

              • memory/4568-142-0x00000000004D0000-0x00000000004E0000-memory.dmp
                Filesize

                64KB

              • memory/4568-141-0x0000000000B10000-0x0000000000E5A000-memory.dmp
                Filesize

                3.3MB

              • memory/4568-140-0x0000000000400000-0x000000000042F000-memory.dmp
                Filesize

                188KB

              • memory/4568-139-0x0000000000400000-0x000000000042F000-memory.dmp
                Filesize

                188KB

              • memory/5044-132-0x0000000000000000-mapping.dmp