Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    17/01/2023, 08:34

General

  • Target

    b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700.exe

  • Size

    225KB

  • MD5

    ffd1f23d797e701acd68c6fafc43ee52

  • SHA1

    9d50d54229d7b5c77ef2ff5b2e8383d857a72c78

  • SHA256

    b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700

  • SHA512

    7ce85f0852546659ff88c74649885599926ad99705afa70403d8f925248c954350b4dec3383e0f9e0aa61ded75b13416dc217eae2064cb3992ed3a67e98b352c

  • SSDEEP

    6144:LkwmZ9d0kAbVgQgvIb3w/zpxuDee5rFrTFFkvyIu2:4Z30b8qARe5ZrTkvyk

Malware Config

Extracted

Family

formbook

Campaign

poub

Decoy

WY0eksfISzRg4O6c+opnGL6gaw==

moRjn9ExtYi8UmUo+Tya

2vME+GedoxzFnuLXesUoVj4=

EvW4JWJ1NQ8nN3tA3SM=

2mK9efMZMgN1VOs=

8d0jua5b0J6AQEW7

/2cyThOd37DSTYMASDye4Q0t/Vs=

ral+tbIh2KKAQEW7

YLY9jsPtYB/FRmMo+Tya

R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=

KFXGg/T1pCC9GjrxUPTcjw==

8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=

c7am8nhhlCo=

UW91trZj6dENxuRdpxOvW1Cf

sjOMUcvq6lYJCZEfV4euFzY=

62nBgPjdmWQkmWElww==

64E8JqA1aruSUvw=

NqI1reXpcR+REye0

8+y1oOsbjgSyEhjXUPTcjw==

Rx9by8gNBwN1VOs=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 3 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Users\Admin\AppData\Local\Temp\b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700.exe
      "C:\Users\Admin\AppData\Local\Temp\b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1016
      • C:\Users\Admin\AppData\Local\Temp\rqpwm.exe
        "C:\Users\Admin\AppData\Local\Temp\rqpwm.exe" C:\Users\Admin\AppData\Local\Temp\ggzllxjrbu.d
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1360
        • C:\Users\Admin\AppData\Local\Temp\rqpwm.exe
          "C:\Users\Admin\AppData\Local\Temp\rqpwm.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1692
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\rqpwm.exe"
        3⤵
          PID:972
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:832

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\ajxwfn.ya

              Filesize

              176KB

              MD5

              e9dc02fcc8d07b8c9fb94bfdafd649dc

              SHA1

              4073f8fd24f056a7d1dc8057ac3b9856b3c5acf8

              SHA256

              ebcbf2884bbab2f4659135df86ee673072f4b4de530b703674fbb92731f893cb

              SHA512

              a1abdb620261820d7575c8e9d85a7ef53df46d8980950a3d3db239e72fca86c951306b8066868f61f8b69d25006316d9265317d580eea5012fbfe5ef8e9a0bda

            • C:\Users\Admin\AppData\Local\Temp\ggzllxjrbu.d

              Filesize

              5KB

              MD5

              eb6b8d229b54bed8469fb9bcebcaa22d

              SHA1

              f4bd8ee98476e8520f2e6b8e014f47002555d7e0

              SHA256

              447204de0bb3b29b0a80fe2d233448dc095825ad00df559278a2a7df01b9be4a

              SHA512

              39ee1775c22328314c2682bbf93252f87cdb03e8d86c612eb8252729b4ae41c06d0953d3f99c925a2747398e2d175d0b76556d37f600f9e4a3c059a24912694c

            • C:\Users\Admin\AppData\Local\Temp\rqpwm.exe

              Filesize

              65KB

              MD5

              c7b994bf4057f869fbf0fdd87058a5b1

              SHA1

              49cd3cb0e992b570ddfb82ee539c91e924fae42d

              SHA256

              9713a086074e9951c6ba4aff6f801c62ca11935aaea623047f21c6b1516174ac

              SHA512

              b3d511e62c54aa201d00b83e520b714efb295a39030b98558d88b499e90b1d2606ca58dbb3aea4e602912ada7c9582738083ae44890b2a183a262bacb8d1b0d9

            • C:\Users\Admin\AppData\Local\Temp\rqpwm.exe

              Filesize

              65KB

              MD5

              c7b994bf4057f869fbf0fdd87058a5b1

              SHA1

              49cd3cb0e992b570ddfb82ee539c91e924fae42d

              SHA256

              9713a086074e9951c6ba4aff6f801c62ca11935aaea623047f21c6b1516174ac

              SHA512

              b3d511e62c54aa201d00b83e520b714efb295a39030b98558d88b499e90b1d2606ca58dbb3aea4e602912ada7c9582738083ae44890b2a183a262bacb8d1b0d9

            • C:\Users\Admin\AppData\Local\Temp\rqpwm.exe

              Filesize

              65KB

              MD5

              c7b994bf4057f869fbf0fdd87058a5b1

              SHA1

              49cd3cb0e992b570ddfb82ee539c91e924fae42d

              SHA256

              9713a086074e9951c6ba4aff6f801c62ca11935aaea623047f21c6b1516174ac

              SHA512

              b3d511e62c54aa201d00b83e520b714efb295a39030b98558d88b499e90b1d2606ca58dbb3aea4e602912ada7c9582738083ae44890b2a183a262bacb8d1b0d9

            • \Users\Admin\AppData\Local\Temp\rqpwm.exe

              Filesize

              65KB

              MD5

              c7b994bf4057f869fbf0fdd87058a5b1

              SHA1

              49cd3cb0e992b570ddfb82ee539c91e924fae42d

              SHA256

              9713a086074e9951c6ba4aff6f801c62ca11935aaea623047f21c6b1516174ac

              SHA512

              b3d511e62c54aa201d00b83e520b714efb295a39030b98558d88b499e90b1d2606ca58dbb3aea4e602912ada7c9582738083ae44890b2a183a262bacb8d1b0d9

            • \Users\Admin\AppData\Local\Temp\rqpwm.exe

              Filesize

              65KB

              MD5

              c7b994bf4057f869fbf0fdd87058a5b1

              SHA1

              49cd3cb0e992b570ddfb82ee539c91e924fae42d

              SHA256

              9713a086074e9951c6ba4aff6f801c62ca11935aaea623047f21c6b1516174ac

              SHA512

              b3d511e62c54aa201d00b83e520b714efb295a39030b98558d88b499e90b1d2606ca58dbb3aea4e602912ada7c9582738083ae44890b2a183a262bacb8d1b0d9

            • \Users\Admin\AppData\Local\Temp\rqpwm.exe

              Filesize

              65KB

              MD5

              c7b994bf4057f869fbf0fdd87058a5b1

              SHA1

              49cd3cb0e992b570ddfb82ee539c91e924fae42d

              SHA256

              9713a086074e9951c6ba4aff6f801c62ca11935aaea623047f21c6b1516174ac

              SHA512

              b3d511e62c54aa201d00b83e520b714efb295a39030b98558d88b499e90b1d2606ca58dbb3aea4e602912ada7c9582738083ae44890b2a183a262bacb8d1b0d9

            • memory/1016-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

              Filesize

              8KB

            • memory/1264-78-0x0000000004DF0000-0x0000000004EF9000-memory.dmp

              Filesize

              1.0MB

            • memory/1264-76-0x0000000004DF0000-0x0000000004EF9000-memory.dmp

              Filesize

              1.0MB

            • memory/1264-69-0x0000000004A00000-0x0000000004AD0000-memory.dmp

              Filesize

              832KB

            • memory/1516-73-0x0000000002130000-0x0000000002433000-memory.dmp

              Filesize

              3.0MB

            • memory/1516-71-0x0000000000D20000-0x0000000000D25000-memory.dmp

              Filesize

              20KB

            • memory/1516-72-0x0000000000080000-0x00000000000AC000-memory.dmp

              Filesize

              176KB

            • memory/1516-75-0x0000000000890000-0x0000000000920000-memory.dmp

              Filesize

              576KB

            • memory/1516-77-0x0000000000080000-0x00000000000AC000-memory.dmp

              Filesize

              176KB

            • memory/1692-68-0x00000000002B0000-0x00000000002C1000-memory.dmp

              Filesize

              68KB

            • memory/1692-67-0x0000000000800000-0x0000000000B03000-memory.dmp

              Filesize

              3.0MB

            • memory/1692-66-0x0000000000400000-0x000000000042C000-memory.dmp

              Filesize

              176KB