Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2023, 20:37

General

  • Target

    58a93d1d064b9e8265ea798531adb0bf.exe

  • Size

    330KB

  • MD5

    58a93d1d064b9e8265ea798531adb0bf

  • SHA1

    d5e30f238fabd304d30ba2c726c71fb47765b494

  • SHA256

    d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c

  • SHA512

    c5e9c0e07ea8904a45011380836ff8f0b936954729df4fb18f62414322f5815ec8ebc5803729a13b783cf87a5bd723fc821405e3579e017c7b19059e57f76bfb

  • SSDEEP

    6144:PYa69K+mD7y0q2hhBCH4m6Qx8qQ5+/ucZiE2TZPwc7j0W6KmZE0HOkv/kBa:PYnUD71qc+6Q+qQuu/Tn396KmLDv/

Malware Config

Extracted

Family

formbook

Campaign

poub

Decoy

WY0eksfISzRg4O6c+opnGL6gaw==

moRjn9ExtYi8UmUo+Tya

2vME+GedoxzFnuLXesUoVj4=

EvW4JWJ1NQ8nN3tA3SM=

2mK9efMZMgN1VOs=

8d0jua5b0J6AQEW7

/2cyThOd37DSTYMASDye4Q0t/Vs=

ral+tbIh2KKAQEW7

YLY9jsPtYB/FRmMo+Tya

R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=

KFXGg/T1pCC9GjrxUPTcjw==

8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=

c7am8nhhlCo=

UW91trZj6dENxuRdpxOvW1Cf

sjOMUcvq6lYJCZEfV4euFzY=

62nBgPjdmWQkmWElww==

64E8JqA1aruSUvw=

NqI1reXpcR+REye0

8+y1oOsbjgSyEhjXUPTcjw==

Rx9by8gNBwN1VOs=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Users\Admin\AppData\Local\Temp\58a93d1d064b9e8265ea798531adb0bf.exe
      "C:\Users\Admin\AppData\Local\Temp\58a93d1d064b9e8265ea798531adb0bf.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
        "C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe" C:\Users\Admin\AppData\Local\Temp\ucpha.v
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4884
        • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
          "C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:900
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe"
        3⤵
          PID:3760

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\hcmpu.cqa

            Filesize

            196KB

            MD5

            28eed71dacb4522dbf2c1aeca39e2c5d

            SHA1

            b5633dcf66f1657552ba992c55e7124250c23a35

            SHA256

            22bfb554d299b3fc4686643b0522384db2c92ebf64bd80475439b8dd9bbe7bc5

            SHA512

            7f08bc8237868fb6509baafd3c4a01663b0577ebec86aef9cb185bec13acb8c5787604329a85c74a2ebbc3f39933929a2f36ea21513330124bd2d66363e54cae

          • C:\Users\Admin\AppData\Local\Temp\ucpha.v

            Filesize

            5KB

            MD5

            d934356067b6133646fad1aa12371a1e

            SHA1

            23fe2ea62be0949a32ea6609345a8b8d27ce3757

            SHA256

            81f2eb3bd3c2135b0d6abdcc4f2e6427a76dac558928d4c8beb648a045010ae5

            SHA512

            26b50a5599353328bfc4609754ead9efd9e4084e4fdb6a9479ad56ea79aed81648de897e66c3dd1c9de1cdb6eba04855e4498f0d8d09f7804224ba27ceab91d8

          • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe

            Filesize

            253KB

            MD5

            d8394c44bc790e1bdab00823f689c1bd

            SHA1

            735d8986424e2ab3440f49a7a720ecaad43d491d

            SHA256

            234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

            SHA512

            c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

          • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe

            Filesize

            253KB

            MD5

            d8394c44bc790e1bdab00823f689c1bd

            SHA1

            735d8986424e2ab3440f49a7a720ecaad43d491d

            SHA256

            234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

            SHA512

            c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

          • C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe

            Filesize

            253KB

            MD5

            d8394c44bc790e1bdab00823f689c1bd

            SHA1

            735d8986424e2ab3440f49a7a720ecaad43d491d

            SHA256

            234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

            SHA512

            c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

          • memory/900-140-0x0000000000A30000-0x0000000000D7A000-memory.dmp

            Filesize

            3.3MB

          • memory/900-139-0x0000000000400000-0x000000000042C000-memory.dmp

            Filesize

            176KB

          • memory/900-141-0x00000000009F0000-0x0000000000A01000-memory.dmp

            Filesize

            68KB

          • memory/900-143-0x0000000000EE0000-0x0000000000EF1000-memory.dmp

            Filesize

            68KB

          • memory/900-146-0x0000000000400000-0x000000000042C000-memory.dmp

            Filesize

            176KB

          • memory/1224-149-0x0000000000A00000-0x0000000000A2C000-memory.dmp

            Filesize

            176KB

          • memory/1224-153-0x0000000000A00000-0x0000000000A2C000-memory.dmp

            Filesize

            176KB

          • memory/1224-151-0x0000000002730000-0x00000000027C0000-memory.dmp

            Filesize

            576KB

          • memory/1224-150-0x00000000028D0000-0x0000000002C1A000-memory.dmp

            Filesize

            3.3MB

          • memory/1224-148-0x00000000006A0000-0x00000000006B4000-memory.dmp

            Filesize

            80KB

          • memory/2640-142-0x0000000007BF0000-0x0000000007D2F000-memory.dmp

            Filesize

            1.2MB

          • memory/2640-144-0x0000000002D70000-0x0000000002E30000-memory.dmp

            Filesize

            768KB

          • memory/2640-152-0x0000000003130000-0x0000000003208000-memory.dmp

            Filesize

            864KB

          • memory/2640-154-0x0000000003130000-0x0000000003208000-memory.dmp

            Filesize

            864KB