Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2022 15:39
Static task
static1
Behavioral task
behavioral1
Sample
7015892.exe
Resource
win7-20221111-en
General
-
Target
7015892.exe
-
Size
252KB
-
MD5
19990004ebbc8bf180d02aeda8246db9
-
SHA1
52ec8c08e69bc87e65388341a633670da979de48
-
SHA256
8f2f6e6735e483a6d8c6aac9817f9bf908e7e63f60a552bb64f8ca77d6c38d0e
-
SHA512
e1ef258c3b4f6335100c18ab5143785fa6c74575370db64f31eb4e5751bb160f01763f111bf85f4b61b955c8446a3d9a21237cc7a32b9ff17d58df3329f82f06
-
SSDEEP
6144:7kw+Uw9SO9UWxHVHl4NON8lk1ycJxRqvROk2sf5:kH9P+Wl4k86ykBnsf5
Malware Config
Extracted
formbook
yurm
X06d1tis1GUX/R0g87Ud
BKiZ33D1P766GVXO1ZwV
lAFdjB7CSxGX8Trz
Gc7dWizTVxWX8Trz
tDkr9JAfi1OHAW1PGOageIp4
bCpMtHKU3mVp8BY5sQ==
7WKpsMWt8nsrhJClJeOZNg==
0A9KTlETQ86Cmd8k0o5NP5RwCg==
aJ61paNJztSp42c=
CrgoA8ySIOsytCbO1ZwV
i46SnHYDD9tTIHI=
XFRCRCjtFZeU3x4Rn3xfD5BnPz+RDA==
c4CZghuHvzW9A31gEz0d
QAjzz9qyRRWBNYseAI4M
Jpbmu4A1YvBvN3ruZgiRmJA5BCFd
PfoFXGNFhhuX8Trz
bqCfk0m8ApAl+Tm1Ms5Tb23IT7tS
z7INff7HNALxc5HWq2/ftrVR6A7R1zvTUQ==
m7IShV4LSFxbqxhrVsZ1Ig==
BHRp7q0gtoRuqBRnVsZ1Ig==
SnqEhE/pEKitAVYv+MtfgDwL1EuxZyihRg==
1xpDKRHJ7K/tqQzEfaJvDIeRWI5DZyihRg==
tAQpBfGi8mppxC4LbDQNI945BCFd
nk5kz8aKDecavxHOYeugeIp4
wPYvLS3zK8FvdJFbQVY=
WAATk07VS0xU9Dvx
KdwXaxSYC9G8DG2tUOBR/X3wtEM=
EPQVcwx5eXw9i/E3B9tpP5RwCg==
MN0FmlPPDZiu5zVpA58wA0Q/5F4=
797QsL+c/saMxtZeQFQ=
TISijiWfydvQFQ==
ama7D8Ntnxsr9Gg=
PcnRSFMPjGFm8BY5sQ==
npSIXvRrsj25h91pUHZGbX3wtEM=
0CAJglT6dkKyhZFbQVY=
kL69pLud0pT4Am0=
sG1JDgXWXydt/VHO1ZwV
zxVdYWYhqoHvrt5W2G7a5PL71zEyHIIx
i0Zm9MhPh/vvI3ycVsZ1Ig==
kjRJqKB3nRgihH2kM0E=
/s4LgD5dmCtOBCkprA==
I278sNm5/o/FX2dZBAKYKg==
eP/5flDtVw2X8Trz
Ik9oUEj8hFO6eeK1gJg/xkILDkwPAw==
QIS5jUjlUhtr/VHO1ZwV
RcC5QQyGv0mFC2BnT3igeIp4
NL7LMCoKT93dJWVTHJgywToxAg==
yzhyPgzSYDGthZFbQVY=
PqmV5ObKBpvKUJZYcGg05HtiCA==
/W9bsq7IsDuC
T8LMKrI2jA8BQ4yQVsZ1Ig==
eHof90VMPMXQDQ==
8TSLglnyajdx/VDO1ZwV
ZQYihA2I+rn4g7eQVsZ1Ig==
JCmxphUQ06is5Gc=
H2C6sYYiZPAxoxNnVsZ1Ig==
5NxIrpR6DM2Jd5FbQVY=
vDCXqaJj6Pw2EXA=
CBI+Gdh67Pw2EXA=
zxoDhkPEDpTET7a6Os0tj1BpDBfmYgo=
neEtD8Y0YN7fMV7O1ZwV
W+BPJ/S6QhmScpFbQVY=
iAZaRHA3ZgUpsQvRiZ5XP5RwCg==
CQtXS8LIsDuC
absbox.org
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
xaxzqjgnle.exexaxzqjgnle.exepid process 1928 xaxzqjgnle.exe 400 xaxzqjgnle.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
xaxzqjgnle.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation xaxzqjgnle.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
xaxzqjgnle.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mjcjhsro = "C:\\Users\\Admin\\AppData\\Roaming\\qfqhbbunerh\\iywsehecpdhm.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xaxzqjgnle.exe\" C:\\Users\\Admin\\AppD" xaxzqjgnle.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
xaxzqjgnle.exexaxzqjgnle.execscript.exedescription pid process target process PID 1928 set thread context of 400 1928 xaxzqjgnle.exe xaxzqjgnle.exe PID 400 set thread context of 2576 400 xaxzqjgnle.exe Explorer.EXE PID 4796 set thread context of 2576 4796 cscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
cscript.exedescription ioc process Key created \Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
xaxzqjgnle.execscript.exepid process 400 xaxzqjgnle.exe 400 xaxzqjgnle.exe 400 xaxzqjgnle.exe 400 xaxzqjgnle.exe 400 xaxzqjgnle.exe 400 xaxzqjgnle.exe 400 xaxzqjgnle.exe 400 xaxzqjgnle.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2576 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
xaxzqjgnle.exexaxzqjgnle.execscript.exepid process 1928 xaxzqjgnle.exe 400 xaxzqjgnle.exe 400 xaxzqjgnle.exe 400 xaxzqjgnle.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe 4796 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
xaxzqjgnle.execscript.exedescription pid process Token: SeDebugPrivilege 400 xaxzqjgnle.exe Token: SeDebugPrivilege 4796 cscript.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
7015892.exexaxzqjgnle.exeExplorer.EXEcscript.exedescription pid process target process PID 960 wrote to memory of 1928 960 7015892.exe xaxzqjgnle.exe PID 960 wrote to memory of 1928 960 7015892.exe xaxzqjgnle.exe PID 960 wrote to memory of 1928 960 7015892.exe xaxzqjgnle.exe PID 1928 wrote to memory of 400 1928 xaxzqjgnle.exe xaxzqjgnle.exe PID 1928 wrote to memory of 400 1928 xaxzqjgnle.exe xaxzqjgnle.exe PID 1928 wrote to memory of 400 1928 xaxzqjgnle.exe xaxzqjgnle.exe PID 1928 wrote to memory of 400 1928 xaxzqjgnle.exe xaxzqjgnle.exe PID 2576 wrote to memory of 4796 2576 Explorer.EXE cscript.exe PID 2576 wrote to memory of 4796 2576 Explorer.EXE cscript.exe PID 2576 wrote to memory of 4796 2576 Explorer.EXE cscript.exe PID 4796 wrote to memory of 4404 4796 cscript.exe Firefox.exe PID 4796 wrote to memory of 4404 4796 cscript.exe Firefox.exe PID 4796 wrote to memory of 4404 4796 cscript.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7015892.exe"C:\Users\Admin\AppData\Local\Temp\7015892.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xaxzqjgnle.exe"C:\Users\Admin\AppData\Local\Temp\xaxzqjgnle.exe" C:\Users\Admin\AppData\Local\Temp\dzwpvwcrqj.oj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xaxzqjgnle.exe"C:\Users\Admin\AppData\Local\Temp\xaxzqjgnle.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dzwpvwcrqj.ojFilesize
7KB
MD52916b6d518c3bdf5e075d4d508a1c018
SHA1915b289191f4e7b047d227d4fd5a12f2248516e8
SHA256d8a93bd1e22142c40e94c6d8194dc0d042dd812512a5ac5dbd90c0fe7e2dcb81
SHA5122d2e8f4d8a8fd2babaa790cdcf60b526c1183857d8cf697258cd3ffb314c66f28c2f57abd351ead45b7078c0502092a4b5a1d8453f36789238c19e0dab25cc33
-
C:\Users\Admin\AppData\Local\Temp\xaxzqjgnle.exeFilesize
49KB
MD53c1561af162e360c5c30261cf146e1a7
SHA120f9c82d73ca27fca387cee2325cfe4a37bb7fc7
SHA25611e2b64630e91db573dc2b8d8a3320bcc951bacd2e18be39ea3cc33fa0741a8b
SHA51261c9ea3710c4cd3e824c9fd1abc9dd22aa804113383ef776790f9dc84b3e1d518325d6e99fa8c3f168460c5f12e5de7373ab03829b2e69a8b216caf26c873bcb
-
C:\Users\Admin\AppData\Local\Temp\xaxzqjgnle.exeFilesize
49KB
MD53c1561af162e360c5c30261cf146e1a7
SHA120f9c82d73ca27fca387cee2325cfe4a37bb7fc7
SHA25611e2b64630e91db573dc2b8d8a3320bcc951bacd2e18be39ea3cc33fa0741a8b
SHA51261c9ea3710c4cd3e824c9fd1abc9dd22aa804113383ef776790f9dc84b3e1d518325d6e99fa8c3f168460c5f12e5de7373ab03829b2e69a8b216caf26c873bcb
-
C:\Users\Admin\AppData\Local\Temp\xaxzqjgnle.exeFilesize
49KB
MD53c1561af162e360c5c30261cf146e1a7
SHA120f9c82d73ca27fca387cee2325cfe4a37bb7fc7
SHA25611e2b64630e91db573dc2b8d8a3320bcc951bacd2e18be39ea3cc33fa0741a8b
SHA51261c9ea3710c4cd3e824c9fd1abc9dd22aa804113383ef776790f9dc84b3e1d518325d6e99fa8c3f168460c5f12e5de7373ab03829b2e69a8b216caf26c873bcb
-
C:\Users\Admin\AppData\Local\Temp\yimkomsixc.nucFilesize
185KB
MD5104a836621fab39a6d275bf55d1d0b7a
SHA1a0b4cb1172a79529f6c23df706008183cadd3acb
SHA256adfbdaa609481911932ba98dcbacbdbd02feca772617461c7c0eada07f5f5e64
SHA5122029ab05a88c83f672b2ace0f38eaeefc006fb51f14f6908b4124c6eaa6279a79e04d7f35f558a2eedc4d24ca8f1b2e8efa0562f5b6fac72701746fc6e286cac
-
memory/400-142-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB
-
memory/400-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/400-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/400-141-0x0000000000A30000-0x0000000000D7A000-memory.dmpFilesize
3.3MB
-
memory/400-137-0x0000000000000000-mapping.dmp
-
memory/1928-132-0x0000000000000000-mapping.dmp
-
memory/2576-149-0x0000000008300000-0x0000000008469000-memory.dmpFilesize
1.4MB
-
memory/2576-143-0x0000000007260000-0x00000000073B9000-memory.dmpFilesize
1.3MB
-
memory/2576-151-0x0000000008300000-0x0000000008469000-memory.dmpFilesize
1.4MB
-
memory/4796-144-0x0000000000000000-mapping.dmp
-
memory/4796-146-0x0000000000940000-0x000000000096D000-memory.dmpFilesize
180KB
-
memory/4796-148-0x0000000002820000-0x00000000028AF000-memory.dmpFilesize
572KB
-
memory/4796-147-0x00000000029F0000-0x0000000002D3A000-memory.dmpFilesize
3.3MB
-
memory/4796-150-0x0000000000940000-0x000000000096D000-memory.dmpFilesize
180KB
-
memory/4796-145-0x00000000003F0000-0x0000000000417000-memory.dmpFilesize
156KB