Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25-01-2023 10:31

General

  • Target

    Doc_230125.xlsx

  • Size

    644KB

  • MD5

    be7a9bc01cfea694a22d463ec14e7e3b

  • SHA1

    1bc1b452bb230be5d4a51484ff4f2771f3792619

  • SHA256

    8d9987b12667c1d3cfd71161c7d18fe4b152557157bed38264120baa49b184be

  • SHA512

    e9543b207f84a9f2cd7f3b8f2c521e7dba9bef53e2d5439993e78d1596f737415f0bf1d82e2f5d4201206c2071a1661da901fbc60d54a3c6d1ecb50da47c0a38

  • SSDEEP

    12288:frxQKDBSm3Wn/xyqZ8/uZv7Ddv4s00jN5jLelzGpEXiqYGwTtfOjOzVcV:tDn3Wn/sqH7Ddgs00/qlYEyLTAi2

Malware Config

Extracted

Family

formbook

Campaign

poub

Decoy

WY0eksfISzRg4O6c+opnGL6gaw==

moRjn9ExtYi8UmUo+Tya

2vME+GedoxzFnuLXesUoVj4=

EvW4JWJ1NQ8nN3tA3SM=

2mK9efMZMgN1VOs=

8d0jua5b0J6AQEW7

/2cyThOd37DSTYMASDye4Q0t/Vs=

ral+tbIh2KKAQEW7

YLY9jsPtYB/FRmMo+Tya

R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=

KFXGg/T1pCC9GjrxUPTcjw==

8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=

c7am8nhhlCo=

UW91trZj6dENxuRdpxOvW1Cf

sjOMUcvq6lYJCZEfV4euFzY=

62nBgPjdmWQkmWElww==

64E8JqA1aruSUvw=

NqI1reXpcR+REye0

8+y1oOsbjgSyEhjXUPTcjw==

Rx9by8gNBwN1VOs=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Doc_230125.xlsx
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:968
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:920
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe"
        3⤵
          PID:1336
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:780
      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Blocklisted process makes network request
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        PID:1536
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Public\name.exe
          2⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:368
          • C:\Users\Public\name.exe
            C:\Users\Public\name.exe
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1168
            • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
              "C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe" C:\Users\Admin\AppData\Local\Temp\ucpha.v
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:748
              • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
                "C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe"
                5⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                PID:1656

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Exploitation for Client Execution

      1
      T1203

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      2
      T1112

      Discovery

      Query Registry

      2
      T1012

      System Information Discovery

      3
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\hcmpu.cqa
        Filesize

        196KB

        MD5

        28eed71dacb4522dbf2c1aeca39e2c5d

        SHA1

        b5633dcf66f1657552ba992c55e7124250c23a35

        SHA256

        22bfb554d299b3fc4686643b0522384db2c92ebf64bd80475439b8dd9bbe7bc5

        SHA512

        7f08bc8237868fb6509baafd3c4a01663b0577ebec86aef9cb185bec13acb8c5787604329a85c74a2ebbc3f39933929a2f36ea21513330124bd2d66363e54cae

      • C:\Users\Admin\AppData\Local\Temp\ucpha.v
        Filesize

        5KB

        MD5

        d934356067b6133646fad1aa12371a1e

        SHA1

        23fe2ea62be0949a32ea6609345a8b8d27ce3757

        SHA256

        81f2eb3bd3c2135b0d6abdcc4f2e6427a76dac558928d4c8beb648a045010ae5

        SHA512

        26b50a5599353328bfc4609754ead9efd9e4084e4fdb6a9479ad56ea79aed81648de897e66c3dd1c9de1cdb6eba04855e4498f0d8d09f7804224ba27ceab91d8

      • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
        Filesize

        253KB

        MD5

        d8394c44bc790e1bdab00823f689c1bd

        SHA1

        735d8986424e2ab3440f49a7a720ecaad43d491d

        SHA256

        234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

        SHA512

        c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

      • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
        Filesize

        253KB

        MD5

        d8394c44bc790e1bdab00823f689c1bd

        SHA1

        735d8986424e2ab3440f49a7a720ecaad43d491d

        SHA256

        234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

        SHA512

        c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

      • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
        Filesize

        253KB

        MD5

        d8394c44bc790e1bdab00823f689c1bd

        SHA1

        735d8986424e2ab3440f49a7a720ecaad43d491d

        SHA256

        234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

        SHA512

        c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

      • C:\Users\Public\name.exe
        Filesize

        330KB

        MD5

        58a93d1d064b9e8265ea798531adb0bf

        SHA1

        d5e30f238fabd304d30ba2c726c71fb47765b494

        SHA256

        d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c

        SHA512

        c5e9c0e07ea8904a45011380836ff8f0b936954729df4fb18f62414322f5815ec8ebc5803729a13b783cf87a5bd723fc821405e3579e017c7b19059e57f76bfb

      • C:\Users\Public\name.exe
        Filesize

        330KB

        MD5

        58a93d1d064b9e8265ea798531adb0bf

        SHA1

        d5e30f238fabd304d30ba2c726c71fb47765b494

        SHA256

        d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c

        SHA512

        c5e9c0e07ea8904a45011380836ff8f0b936954729df4fb18f62414322f5815ec8ebc5803729a13b783cf87a5bd723fc821405e3579e017c7b19059e57f76bfb

      • \Users\Admin\AppData\Local\Temp\xnozsgld.exe
        Filesize

        253KB

        MD5

        d8394c44bc790e1bdab00823f689c1bd

        SHA1

        735d8986424e2ab3440f49a7a720ecaad43d491d

        SHA256

        234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

        SHA512

        c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

      • \Users\Admin\AppData\Local\Temp\xnozsgld.exe
        Filesize

        253KB

        MD5

        d8394c44bc790e1bdab00823f689c1bd

        SHA1

        735d8986424e2ab3440f49a7a720ecaad43d491d

        SHA256

        234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

        SHA512

        c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

      • \Users\Public\name.exe
        Filesize

        330KB

        MD5

        58a93d1d064b9e8265ea798531adb0bf

        SHA1

        d5e30f238fabd304d30ba2c726c71fb47765b494

        SHA256

        d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c

        SHA512

        c5e9c0e07ea8904a45011380836ff8f0b936954729df4fb18f62414322f5815ec8ebc5803729a13b783cf87a5bd723fc821405e3579e017c7b19059e57f76bfb

      • memory/368-60-0x0000000000000000-mapping.dmp
      • memory/748-67-0x0000000000000000-mapping.dmp
      • memory/920-82-0x0000000000000000-mapping.dmp
      • memory/920-86-0x00000000000F0000-0x000000000010C000-memory.dmp
        Filesize

        112KB

      • memory/920-90-0x0000000000080000-0x00000000000AC000-memory.dmp
        Filesize

        176KB

      • memory/920-89-0x0000000001D50000-0x0000000001DE0000-memory.dmp
        Filesize

        576KB

      • memory/920-88-0x0000000001F90000-0x0000000002293000-memory.dmp
        Filesize

        3.0MB

      • memory/920-87-0x0000000000080000-0x00000000000AC000-memory.dmp
        Filesize

        176KB

      • memory/968-55-0x0000000071371000-0x0000000071373000-memory.dmp
        Filesize

        8KB

      • memory/968-57-0x000000007235D000-0x0000000072368000-memory.dmp
        Filesize

        44KB

      • memory/968-94-0x000000007235D000-0x0000000072368000-memory.dmp
        Filesize

        44KB

      • memory/968-77-0x000000006CB11000-0x000000006CB13000-memory.dmp
        Filesize

        8KB

      • memory/968-93-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/968-58-0x0000000075501000-0x0000000075503000-memory.dmp
        Filesize

        8KB

      • memory/968-69-0x000000006C641000-0x000000006C643000-memory.dmp
        Filesize

        8KB

      • memory/968-81-0x000000007235D000-0x0000000072368000-memory.dmp
        Filesize

        44KB

      • memory/968-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/968-54-0x000000002F4B1000-0x000000002F4B4000-memory.dmp
        Filesize

        12KB

      • memory/1168-63-0x0000000000000000-mapping.dmp
      • memory/1224-80-0x0000000006B70000-0x0000000006CCD000-memory.dmp
        Filesize

        1.4MB

      • memory/1224-91-0x0000000006CD0000-0x0000000006E18000-memory.dmp
        Filesize

        1.3MB

      • memory/1224-92-0x0000000006CD0000-0x0000000006E18000-memory.dmp
        Filesize

        1.3MB

      • memory/1336-85-0x0000000000000000-mapping.dmp
      • memory/1656-74-0x000000000041FF10-mapping.dmp
      • memory/1656-83-0x0000000000400000-0x000000000042C000-memory.dmp
        Filesize

        176KB

      • memory/1656-79-0x00000000002C0000-0x00000000002D1000-memory.dmp
        Filesize

        68KB

      • memory/1656-78-0x0000000000830000-0x0000000000B33000-memory.dmp
        Filesize

        3.0MB

      • memory/1656-76-0x0000000000400000-0x000000000042C000-memory.dmp
        Filesize

        176KB