Analysis

  • max time kernel
    159s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2023, 08:34

General

  • Target

    b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700.exe

  • Size

    225KB

  • MD5

    ffd1f23d797e701acd68c6fafc43ee52

  • SHA1

    9d50d54229d7b5c77ef2ff5b2e8383d857a72c78

  • SHA256

    b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700

  • SHA512

    7ce85f0852546659ff88c74649885599926ad99705afa70403d8f925248c954350b4dec3383e0f9e0aa61ded75b13416dc217eae2064cb3992ed3a67e98b352c

  • SSDEEP

    6144:LkwmZ9d0kAbVgQgvIb3w/zpxuDee5rFrTFFkvyIu2:4Z30b8qARe5ZrTkvyk

Malware Config

Extracted

Family

formbook

Campaign

poub

Decoy

WY0eksfISzRg4O6c+opnGL6gaw==

moRjn9ExtYi8UmUo+Tya

2vME+GedoxzFnuLXesUoVj4=

EvW4JWJ1NQ8nN3tA3SM=

2mK9efMZMgN1VOs=

8d0jua5b0J6AQEW7

/2cyThOd37DSTYMASDye4Q0t/Vs=

ral+tbIh2KKAQEW7

YLY9jsPtYB/FRmMo+Tya

R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=

KFXGg/T1pCC9GjrxUPTcjw==

8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=

c7am8nhhlCo=

UW91trZj6dENxuRdpxOvW1Cf

sjOMUcvq6lYJCZEfV4euFzY=

62nBgPjdmWQkmWElww==

64E8JqA1aruSUvw=

NqI1reXpcR+REye0

8+y1oOsbjgSyEhjXUPTcjw==

Rx9by8gNBwN1VOs=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700.exe
      "C:\Users\Admin\AppData\Local\Temp\b304ea7c0c21af9a1e1787461fb6577cd05a358fad427a8c33a531449928e700.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Users\Admin\AppData\Local\Temp\rqpwm.exe
        "C:\Users\Admin\AppData\Local\Temp\rqpwm.exe" C:\Users\Admin\AppData\Local\Temp\ggzllxjrbu.d
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1136
        • C:\Users\Admin\AppData\Local\Temp\rqpwm.exe
          "C:\Users\Admin\AppData\Local\Temp\rqpwm.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:4300
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\rqpwm.exe"
        3⤵
          PID:848
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:3164
          • C:\Windows\SysWOW64\cmd.exe
            /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
            3⤵
              PID:4316
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:2860

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\DB1

                  Filesize

                  40KB

                  MD5

                  b608d407fc15adea97c26936bc6f03f6

                  SHA1

                  953e7420801c76393902c0d6bb56148947e41571

                  SHA256

                  b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                  SHA512

                  cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

                • C:\Users\Admin\AppData\Local\Temp\DB1

                  Filesize

                  48KB

                  MD5

                  349e6eb110e34a08924d92f6b334801d

                  SHA1

                  bdfb289daff51890cc71697b6322aa4b35ec9169

                  SHA256

                  c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                  SHA512

                  2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                • C:\Users\Admin\AppData\Local\Temp\ajxwfn.ya

                  Filesize

                  176KB

                  MD5

                  e9dc02fcc8d07b8c9fb94bfdafd649dc

                  SHA1

                  4073f8fd24f056a7d1dc8057ac3b9856b3c5acf8

                  SHA256

                  ebcbf2884bbab2f4659135df86ee673072f4b4de530b703674fbb92731f893cb

                  SHA512

                  a1abdb620261820d7575c8e9d85a7ef53df46d8980950a3d3db239e72fca86c951306b8066868f61f8b69d25006316d9265317d580eea5012fbfe5ef8e9a0bda

                • C:\Users\Admin\AppData\Local\Temp\ggzllxjrbu.d

                  Filesize

                  5KB

                  MD5

                  eb6b8d229b54bed8469fb9bcebcaa22d

                  SHA1

                  f4bd8ee98476e8520f2e6b8e014f47002555d7e0

                  SHA256

                  447204de0bb3b29b0a80fe2d233448dc095825ad00df559278a2a7df01b9be4a

                  SHA512

                  39ee1775c22328314c2682bbf93252f87cdb03e8d86c612eb8252729b4ae41c06d0953d3f99c925a2747398e2d175d0b76556d37f600f9e4a3c059a24912694c

                • C:\Users\Admin\AppData\Local\Temp\rqpwm.exe

                  Filesize

                  65KB

                  MD5

                  c7b994bf4057f869fbf0fdd87058a5b1

                  SHA1

                  49cd3cb0e992b570ddfb82ee539c91e924fae42d

                  SHA256

                  9713a086074e9951c6ba4aff6f801c62ca11935aaea623047f21c6b1516174ac

                  SHA512

                  b3d511e62c54aa201d00b83e520b714efb295a39030b98558d88b499e90b1d2606ca58dbb3aea4e602912ada7c9582738083ae44890b2a183a262bacb8d1b0d9

                • C:\Users\Admin\AppData\Local\Temp\rqpwm.exe

                  Filesize

                  65KB

                  MD5

                  c7b994bf4057f869fbf0fdd87058a5b1

                  SHA1

                  49cd3cb0e992b570ddfb82ee539c91e924fae42d

                  SHA256

                  9713a086074e9951c6ba4aff6f801c62ca11935aaea623047f21c6b1516174ac

                  SHA512

                  b3d511e62c54aa201d00b83e520b714efb295a39030b98558d88b499e90b1d2606ca58dbb3aea4e602912ada7c9582738083ae44890b2a183a262bacb8d1b0d9

                • C:\Users\Admin\AppData\Local\Temp\rqpwm.exe

                  Filesize

                  65KB

                  MD5

                  c7b994bf4057f869fbf0fdd87058a5b1

                  SHA1

                  49cd3cb0e992b570ddfb82ee539c91e924fae42d

                  SHA256

                  9713a086074e9951c6ba4aff6f801c62ca11935aaea623047f21c6b1516174ac

                  SHA512

                  b3d511e62c54aa201d00b83e520b714efb295a39030b98558d88b499e90b1d2606ca58dbb3aea4e602912ada7c9582738083ae44890b2a183a262bacb8d1b0d9

                • memory/2540-144-0x0000000008220000-0x0000000008330000-memory.dmp

                  Filesize

                  1.1MB

                • memory/2540-154-0x0000000008BD0000-0x0000000008CED000-memory.dmp

                  Filesize

                  1.1MB

                • memory/2540-142-0x0000000008110000-0x000000000821D000-memory.dmp

                  Filesize

                  1.1MB

                • memory/2540-153-0x0000000008BD0000-0x0000000008CED000-memory.dmp

                  Filesize

                  1.1MB

                • memory/4300-143-0x0000000000730000-0x0000000000741000-memory.dmp

                  Filesize

                  68KB

                • memory/4300-141-0x00000000006C0000-0x00000000006D1000-memory.dmp

                  Filesize

                  68KB

                • memory/4300-145-0x0000000000400000-0x000000000042C000-memory.dmp

                  Filesize

                  176KB

                • memory/4300-140-0x0000000000A50000-0x0000000000D9A000-memory.dmp

                  Filesize

                  3.3MB

                • memory/4300-139-0x0000000000400000-0x000000000042C000-memory.dmp

                  Filesize

                  176KB

                • memory/4592-152-0x00000000020C0000-0x0000000002150000-memory.dmp

                  Filesize

                  576KB

                • memory/4592-151-0x0000000000190000-0x00000000001BC000-memory.dmp

                  Filesize

                  176KB

                • memory/4592-150-0x0000000002390000-0x00000000026DA000-memory.dmp

                  Filesize

                  3.3MB

                • memory/4592-148-0x0000000000870000-0x000000000087C000-memory.dmp

                  Filesize

                  48KB

                • memory/4592-149-0x0000000000190000-0x00000000001BC000-memory.dmp

                  Filesize

                  176KB