Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25-01-2023 10:31

General

  • Target

    Doc_230125.xlsx

  • Size

    644KB

  • MD5

    be7a9bc01cfea694a22d463ec14e7e3b

  • SHA1

    1bc1b452bb230be5d4a51484ff4f2771f3792619

  • SHA256

    8d9987b12667c1d3cfd71161c7d18fe4b152557157bed38264120baa49b184be

  • SHA512

    e9543b207f84a9f2cd7f3b8f2c521e7dba9bef53e2d5439993e78d1596f737415f0bf1d82e2f5d4201206c2071a1661da901fbc60d54a3c6d1ecb50da47c0a38

  • SSDEEP

    12288:frxQKDBSm3Wn/xyqZ8/uZv7Ddv4s00jN5jLelzGpEXiqYGwTtfOjOzVcV:tDn3Wn/sqH7Ddgs00/qlYEyLTAi2

Malware Config

Extracted

Family

formbook

Campaign

poub

Decoy

WY0eksfISzRg4O6c+opnGL6gaw==

moRjn9ExtYi8UmUo+Tya

2vME+GedoxzFnuLXesUoVj4=

EvW4JWJ1NQ8nN3tA3SM=

2mK9efMZMgN1VOs=

8d0jua5b0J6AQEW7

/2cyThOd37DSTYMASDye4Q0t/Vs=

ral+tbIh2KKAQEW7

YLY9jsPtYB/FRmMo+Tya

R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=

KFXGg/T1pCC9GjrxUPTcjw==

8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=

c7am8nhhlCo=

UW91trZj6dENxuRdpxOvW1Cf

sjOMUcvq6lYJCZEfV4euFzY=

62nBgPjdmWQkmWElww==

64E8JqA1aruSUvw=

NqI1reXpcR+REye0

8+y1oOsbjgSyEhjXUPTcjw==

Rx9by8gNBwN1VOs=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Doc_230125.xlsx
      Enumerates system info in registry
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:968
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      Adds policy Run key to start application
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:920
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe"
        PID:1336
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        PID:780
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    Blocklisted process makes network request
    Launches Equation Editor
    Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Public\name.exe
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:368
      • C:\Users\Public\name.exe
        C:\Users\Public\name.exe
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        PID:1168
        • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
          "C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe" C:\Users\Admin\AppData\Local\Temp\ucpha.v
          Executes dropped EXE
          Loads dropped DLL
          Suspicious use of SetThreadContext
          Suspicious behavior: MapViewOfSection
          Suspicious use of WriteProcessMemory
          PID:748
          • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
            "C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe"
            Executes dropped EXE
            Checks computer location settings
            Suspicious use of SetThreadContext
            Suspicious behavior: EnumeratesProcesses
            Suspicious behavior: MapViewOfSection
            Suspicious use of AdjustPrivilegeToken
            PID:1656

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Exfiltration

Impact

Initial Access

Lateral Movement

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hcmpu.cqa
    Filesize

    196KB

    MD5

    28eed71dacb4522dbf2c1aeca39e2c5d

    SHA1

    b5633dcf66f1657552ba992c55e7124250c23a35

    SHA256

    22bfb554d299b3fc4686643b0522384db2c92ebf64bd80475439b8dd9bbe7bc5

    SHA512

    7f08bc8237868fb6509baafd3c4a01663b0577ebec86aef9cb185bec13acb8c5787604329a85c74a2ebbc3f39933929a2f36ea21513330124bd2d66363e54cae

  • C:\Users\Admin\AppData\Local\Temp\ucpha.v
    Filesize

    5KB

    MD5

    d934356067b6133646fad1aa12371a1e

    SHA1

    23fe2ea62be0949a32ea6609345a8b8d27ce3757

    SHA256

    81f2eb3bd3c2135b0d6abdcc4f2e6427a76dac558928d4c8beb648a045010ae5

    SHA512

    26b50a5599353328bfc4609754ead9efd9e4084e4fdb6a9479ad56ea79aed81648de897e66c3dd1c9de1cdb6eba04855e4498f0d8d09f7804224ba27ceab91d8

  • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
    Filesize

    253KB

    MD5

    d8394c44bc790e1bdab00823f689c1bd

    SHA1

    735d8986424e2ab3440f49a7a720ecaad43d491d

    SHA256

    234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

    SHA512

    c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

  • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
    Filesize

    253KB

    MD5

    d8394c44bc790e1bdab00823f689c1bd

    SHA1

    735d8986424e2ab3440f49a7a720ecaad43d491d

    SHA256

    234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

    SHA512

    c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

  • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
    Filesize

    253KB

    MD5

    d8394c44bc790e1bdab00823f689c1bd

    SHA1

    735d8986424e2ab3440f49a7a720ecaad43d491d

    SHA256

    234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

    SHA512

    c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

  • C:\Users\Public\name.exe
    Filesize

    330KB

    MD5

    58a93d1d064b9e8265ea798531adb0bf

    SHA1

    d5e30f238fabd304d30ba2c726c71fb47765b494

    SHA256

    d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c

    SHA512

    c5e9c0e07ea8904a45011380836ff8f0b936954729df4fb18f62414322f5815ec8ebc5803729a13b783cf87a5bd723fc821405e3579e017c7b19059e57f76bfb

  • C:\Users\Public\name.exe
    Filesize

    330KB

    MD5

    58a93d1d064b9e8265ea798531adb0bf

    SHA1

    d5e30f238fabd304d30ba2c726c71fb47765b494

    SHA256

    d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c

    SHA512

    c5e9c0e07ea8904a45011380836ff8f0b936954729df4fb18f62414322f5815ec8ebc5803729a13b783cf87a5bd723fc821405e3579e017c7b19059e57f76bfb

  • \Users\Admin\AppData\Local\Temp\xnozsgld.exe
    Filesize

    253KB

    MD5

    d8394c44bc790e1bdab00823f689c1bd

    SHA1

    735d8986424e2ab3440f49a7a720ecaad43d491d

    SHA256

    234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

    SHA512

    c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

  • \Users\Admin\AppData\Local\Temp\xnozsgld.exe
    Filesize

    253KB

    MD5

    d8394c44bc790e1bdab00823f689c1bd

    SHA1

    735d8986424e2ab3440f49a7a720ecaad43d491d

    SHA256

    234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

    SHA512

    c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

  • \Users\Public\name.exe
    Filesize

    330KB

    MD5

    58a93d1d064b9e8265ea798531adb0bf

    SHA1

    d5e30f238fabd304d30ba2c726c71fb47765b494

    SHA256

    d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c

    SHA512

    c5e9c0e07ea8904a45011380836ff8f0b936954729df4fb18f62414322f5815ec8ebc5803729a13b783cf87a5bd723fc821405e3579e017c7b19059e57f76bfb

  • memory/368-60-0x0000000000000000-mapping.dmp
  • memory/748-67-0x0000000000000000-mapping.dmp
  • memory/920-82-0x0000000000000000-mapping.dmp
  • memory/920-86-0x00000000000F0000-0x000000000010C000-memory.dmp
    Filesize

    112KB

  • memory/920-90-0x0000000000080000-0x00000000000AC000-memory.dmp
    Filesize

    176KB

  • memory/920-89-0x0000000001D50000-0x0000000001DE0000-memory.dmp
    Filesize

    576KB

  • memory/920-88-0x0000000001F90000-0x0000000002293000-memory.dmp
    Filesize

    3MB

  • memory/920-87-0x0000000000080000-0x00000000000AC000-memory.dmp
    Filesize

    176KB

  • memory/968-55-0x0000000071371000-0x0000000071373000-memory.dmp
    Filesize

    8KB

  • memory/968-57-0x000000007235D000-0x0000000072368000-memory.dmp
    Filesize

    44KB

  • memory/968-94-0x000000007235D000-0x0000000072368000-memory.dmp
    Filesize

    44KB

  • memory/968-77-0x000000006CB11000-0x000000006CB13000-memory.dmp
    Filesize

    8KB

  • memory/968-93-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/968-58-0x0000000075501000-0x0000000075503000-memory.dmp
    Filesize

    8KB

  • memory/968-69-0x000000006C641000-0x000000006C643000-memory.dmp
    Filesize

    8KB

  • memory/968-81-0x000000007235D000-0x0000000072368000-memory.dmp
    Filesize

    44KB

  • memory/968-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/968-54-0x000000002F4B1000-0x000000002F4B4000-memory.dmp
    Filesize

    12KB

  • memory/1168-63-0x0000000000000000-mapping.dmp
  • memory/1224-80-0x0000000006B70000-0x0000000006CCD000-memory.dmp
    Filesize

    1MB

  • memory/1224-91-0x0000000006CD0000-0x0000000006E18000-memory.dmp
    Filesize

    1MB

  • memory/1224-92-0x0000000006CD0000-0x0000000006E18000-memory.dmp
    Filesize

    1MB

  • memory/1336-85-0x0000000000000000-mapping.dmp
  • memory/1656-74-0x000000000041FF10-mapping.dmp
  • memory/1656-83-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

  • memory/1656-79-0x00000000002C0000-0x00000000002D1000-memory.dmp
    Filesize

    68KB

  • memory/1656-78-0x0000000000830000-0x0000000000B33000-memory.dmp
    Filesize

    3MB

  • memory/1656-76-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB