Overview

overview

10

Static

static

SecuriteIn...81.exe

windows7_x64

10

SecuriteIn...81.exe

windows10_x64

10

Analysis

  • max time kernel
    58s
  • max time network
    15s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    16/12/2020, 13:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Backdoor.MSIL.REMCOS.SM.16081.exe
  • Size 575KB
  • Sample201216-jss9wf6f16
  • SHA256 7cea909eb4fef13fdeee846b808200826a8de0292ba555bcc4fefdde642dbb55
  • MD5 SHA1 SHA512
Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.rizrvd.com/bw82/

Decoy

  • fundamentaliemef.com

  • gallerybrows.com

  • leadeligey.com

  • octoberx2.online

  • climaxnovels.com

  • gdsjgf.com

  • curateherstories.com

  • blacksailus.com

  • yjpps.com

  • gmobilet.com

  • fcoins.club

  • foreverlive2027.com

  • healthyfifties.com

  • wmarquezy.com

  • housebulb.com

  • thebabyfriendly.com

  • primajayaintiperkasa.com

  • learnplaychess.com

  • chrisbubser.digital

  • xn--avenr-wsa.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Backdoor.MSIL.REMCOS.SM.16081.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Backdoor.MSIL.REMCOS.SM.16081.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:788
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Backdoor.MSIL.REMCOS.SM.16081.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Backdoor.MSIL.REMCOS.SM.16081.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1292

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/788-2-0x0000000074DA0000-0x000000007548E000-memory.dmp
        Download

        memory/788-3-0x00000000009C0000-0x00000000009C1000-memory.dmp
        Download

        memory/788-5-0x0000000000580000-0x0000000000592000-memory.dmp
        Download

        memory/788-6-0x0000000004800000-0x0000000004851000-memory.dmp
        Download

        memory/788-7-0x0000000000660000-0x0000000000668000-memory.dmp
        Download

        memory/788-9-0x0000000000FA0000-0x0000000000FD4000-memory.dmp
        Download

        memory/1292-10-0x0000000000400000-0x0000000000428000-memory.dmp
        Download