Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/01/2023, 09:29

General

  • Target

    3290889312a146f7ed60102439cb580f84057c98c530c31cae7461b2764f5ad4.exe

  • Size

    249KB

  • MD5

    f020e4ab9dacdc83e6b1a4537b5338bc

  • SHA1

    2006686a3a91ed7892cffc9b1bc68c57d59118b3

  • SHA256

    3290889312a146f7ed60102439cb580f84057c98c530c31cae7461b2764f5ad4

  • SHA512

    b959b9b3cebd08a09dddad4933be828a3ce4d45269d64121cb2009898e2cc0508fd36ee7b3bb1dc00ed32ca7071d59a0173b3d17ac88184b8a083ef64820585a

  • SSDEEP

    6144:/Ya6BvdSq4hdciqjFhWgbFGj9xyD9LDRHOW4zVQ60HIV0yLP:/YLFL4hdcfjGj9xyVFOPWyz

Malware Config

Extracted

Family

formbook

Campaign

poub

Decoy

WY0eksfISzRg4O6c+opnGL6gaw==

moRjn9ExtYi8UmUo+Tya

2vME+GedoxzFnuLXesUoVj4=

EvW4JWJ1NQ8nN3tA3SM=

2mK9efMZMgN1VOs=

8d0jua5b0J6AQEW7

/2cyThOd37DSTYMASDye4Q0t/Vs=

ral+tbIh2KKAQEW7

YLY9jsPtYB/FRmMo+Tya

R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=

KFXGg/T1pCC9GjrxUPTcjw==

8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=

c7am8nhhlCo=

UW91trZj6dENxuRdpxOvW1Cf

sjOMUcvq6lYJCZEfV4euFzY=

62nBgPjdmWQkmWElww==

64E8JqA1aruSUvw=

NqI1reXpcR+REye0

8+y1oOsbjgSyEhjXUPTcjw==

Rx9by8gNBwN1VOs=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\3290889312a146f7ed60102439cb580f84057c98c530c31cae7461b2764f5ad4.exe
      "C:\Users\Admin\AppData\Local\Temp\3290889312a146f7ed60102439cb580f84057c98c530c31cae7461b2764f5ad4.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3676
      • C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe
        "C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe" C:\Users\Admin\AppData\Local\Temp\rznlc.m
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe
          "C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:944
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\SysWOW64\mstsc.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1860
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe"
        3⤵
          PID:5008
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:4540
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            3⤵
              PID:5056

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\DB1

                Filesize

                40KB

                MD5

                b608d407fc15adea97c26936bc6f03f6

                SHA1

                953e7420801c76393902c0d6bb56148947e41571

                SHA256

                b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                SHA512

                cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

              • C:\Users\Admin\AppData\Local\Temp\nfekeauyiy.uih

                Filesize

                196KB

                MD5

                62db7e07dd4481e9b594a97c4b97281a

                SHA1

                0996af042cee334be6c8d71b689e1c3405dba59e

                SHA256

                e0ab3c275ba03990a2f28abd8f37f8ff078fb8dce7fb939c6029631a5b4018a6

                SHA512

                90823ffa0232b7c18bb927dfbd87f4e5220bcf8e23f55d6638ac6ca26c29341c2ed80b2039f3893323a315071f64c572cbee70f33dd9fa2c723465a6b476e23a

              • C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe

                Filesize

                50KB

                MD5

                f73f9940d91bb012db1ea328b3897c82

                SHA1

                a2168931605a10f3604dc2c24504d82a51ab6e99

                SHA256

                2cd78183a6fca82b8e05a38466051f56529a1f5843cfd6bf7274ffe30e9abf57

                SHA512

                e74c2ac031aab4ede16a0b2525a22545b555c3e659fed10079a9921e3620e42b22f2052ec5f930519881a3b7e2dd1afbd0931d1696d99e516466314b90aa217a

              • C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe

                Filesize

                50KB

                MD5

                f73f9940d91bb012db1ea328b3897c82

                SHA1

                a2168931605a10f3604dc2c24504d82a51ab6e99

                SHA256

                2cd78183a6fca82b8e05a38466051f56529a1f5843cfd6bf7274ffe30e9abf57

                SHA512

                e74c2ac031aab4ede16a0b2525a22545b555c3e659fed10079a9921e3620e42b22f2052ec5f930519881a3b7e2dd1afbd0931d1696d99e516466314b90aa217a

              • C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe

                Filesize

                50KB

                MD5

                f73f9940d91bb012db1ea328b3897c82

                SHA1

                a2168931605a10f3604dc2c24504d82a51ab6e99

                SHA256

                2cd78183a6fca82b8e05a38466051f56529a1f5843cfd6bf7274ffe30e9abf57

                SHA512

                e74c2ac031aab4ede16a0b2525a22545b555c3e659fed10079a9921e3620e42b22f2052ec5f930519881a3b7e2dd1afbd0931d1696d99e516466314b90aa217a

              • C:\Users\Admin\AppData\Local\Temp\rznlc.m

                Filesize

                5KB

                MD5

                56075b8221603dd51f2e7cc79097c954

                SHA1

                0df59bf418b3398bb248b63ff834e7dea05596f0

                SHA256

                0775d03420d1805c24855734fdcbe12f7dc1d1bd150b345274495054b41576dc

                SHA512

                47bb8745800a315fb7f8b6717a70fa6b5c648309c02954bb41faccd29c42be7d8e6a1d1de1cae946e2893cb0660be93fd6487891364941279656723db004086c

              • memory/944-213-0x0000000000400000-0x000000000042C000-memory.dmp

                Filesize

                176KB

              • memory/944-230-0x0000000000990000-0x0000000000B2F000-memory.dmp

                Filesize

                1.6MB

              • memory/944-229-0x0000000000B30000-0x0000000000E50000-memory.dmp

                Filesize

                3.1MB

              • memory/944-235-0x0000000000400000-0x000000000042C000-memory.dmp

                Filesize

                176KB

              • memory/1860-290-0x0000000004710000-0x0000000004A30000-memory.dmp

                Filesize

                3.1MB

              • memory/1860-289-0x00000000006C0000-0x00000000006EC000-memory.dmp

                Filesize

                176KB

              • memory/1860-288-0x0000000000B40000-0x0000000000E3C000-memory.dmp

                Filesize

                3.0MB

              • memory/1860-291-0x00000000043D0000-0x0000000004561000-memory.dmp

                Filesize

                1.6MB

              • memory/1860-293-0x00000000006C0000-0x00000000006EC000-memory.dmp

                Filesize

                176KB

              • memory/1860-294-0x00000000043D0000-0x0000000004561000-memory.dmp

                Filesize

                1.6MB

              • memory/3048-231-0x0000000002520000-0x00000000025E1000-memory.dmp

                Filesize

                772KB

              • memory/3048-292-0x0000000004D50000-0x0000000004E65000-memory.dmp

                Filesize

                1.1MB

              • memory/3048-295-0x0000000004D50000-0x0000000004E65000-memory.dmp

                Filesize

                1.1MB

              • memory/3676-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-134-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-141-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-143-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-148-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-142-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-152-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-155-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-157-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-118-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-119-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-120-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-121-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-122-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-123-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-124-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-125-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-126-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-127-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-129-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-128-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-131-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-132-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-133-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-130-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-140-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-135-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-136-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/3676-137-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-181-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-184-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-179-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-177-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-183-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-180-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-172-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-170-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB

              • memory/4812-182-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                Filesize

                1.6MB