Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-09-2024 14:09

General

  • Target

    Trojan.Win32.FormBook.AR.exe

  • Size

    524KB

  • MD5

    e125cbe585e654316d5ab0c2a73bd830

  • SHA1

    62bf4c0a8fbd8a30663e468cf865b1c6e5f5a7bc

  • SHA256

    7d9ccf7be546cdad2baab25c98336224ae050f477594647c9a8adf6b8700011a

  • SHA512

    57d6ae7a7b4c13d23f0ac17a1a684a81155a4e233a107fc275e5d901db70dd4d246f7f746852d4bf4bfd17c522f0ef7e666e983f766c04248b885e044dcc704c

  • SSDEEP

    12288:X9pL8dQnSsG5u8j/cYRHFuVP32+8AEDuME4lbMIOy:X9pL8dQnSsG5umRHFKD8AED+ibMXy

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ma3c

Decoy

bensimonconstructions.com

margaretta.info

getreireply.com

jamierighetti.com

gxjljc.com

internet-exerzitien.com

appetiteintelligence.com

buscar-id-apple.com

unique-bikinis.com

enclassique.com

dafontonline.com

northamericancarbonexchange.com

yashasvsaluja.com

sn-international.com

humanvitality.site

sarahcasias.com

xn--vrv276h3cb.com

curiget.xyz

anxietyattackscure.com

angelstonecrystals.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1148
      • C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.FormBook.AR.exe
        "C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.FormBook.AR.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.FormBook.AR.exe
          "C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.FormBook.AR.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2336
          • C:\Windows\SysWOW64\raserver.exe
            "C:\Windows\SysWOW64\raserver.exe"
            4⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2728
            • C:\Windows\SysWOW64\cmd.exe
              /c del "C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.FormBook.AR.exe"
              5⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:2076

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1148-7-0x0000000006430000-0x0000000006528000-memory.dmp

      Filesize

      992KB

    • memory/1148-3-0x0000000000010000-0x0000000000020000-memory.dmp

      Filesize

      64KB

    • memory/1148-4-0x0000000006300000-0x0000000006428000-memory.dmp

      Filesize

      1.2MB

    • memory/1148-8-0x0000000006300000-0x0000000006428000-memory.dmp

      Filesize

      1.2MB

    • memory/1148-15-0x0000000006430000-0x0000000006528000-memory.dmp

      Filesize

      992KB

    • memory/1756-0-0x0000000000442000-0x000000000044B000-memory.dmp

      Filesize

      36KB

    • memory/2336-1-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2336-2-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2336-6-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2336-5-0x000000000041D000-0x000000000041E000-memory.dmp

      Filesize

      4KB

    • memory/2728-14-0x0000000000AF0000-0x0000000000B0C000-memory.dmp

      Filesize

      112KB

    • memory/2728-13-0x0000000000AF0000-0x0000000000B0C000-memory.dmp

      Filesize

      112KB

    • memory/2728-16-0x0000000000080000-0x00000000000A9000-memory.dmp

      Filesize

      164KB