Overview

overview

10

Static

static

rtgs_pdf.exe

windows7_x64

10

rtgs_pdf.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    17/12/2020, 08:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    rtgs_pdf.exe
  • Size 307KB
  • Sample201217-3q2js1a5f2
  • SHA256 b2f4176efc7fb22a1958f63af6f3029b8d4fdbecb98625828822d471a6a137b4
  • MD5 SHA1 SHA512
Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.fhmaluxury.com/rerx/

Decoy

  • cyberessentialstutor.com

  • theemergingleadership.com

  • lurapures.com

  • escapenet.cloud

  • schoolofdigitalmasters.com

  • hammockextreme.com

  • setejiako.com

  • southshoredistrictreviews.com

  • activityhacker.com

  • gentlemancosmeticos.com

  • artistictouches.co.uk

  • hubtekweb.com

  • dsr.cool

  • timberlandbarataspt.com

  • aberdeentwp.com

  • basicbitchbugspray.com

  • brandaffektion.com

  • popuplomi.com

  • gaming-alpha.com

  • winterfestfortheholidays.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 3 IoCs
    rat
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 75 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Users\Admin\AppData\Local\Temp\rtgs_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\rtgs_pdf.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2604
      • C:\Users\Admin\AppData\Local\Temp\rtgs_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\rtgs_pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4044
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 1080
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3608
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\SysWOW64\mstsc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:68
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\rtgs_pdf.exe"
        3⤵
          PID:748

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/68-8-0x0000000001220000-0x000000000151C000-memory.dmp
          Download

          memory/68-9-0x0000000001220000-0x000000000151C000-memory.dmp
          Download

          memory/3608-5-0x0000000005010000-0x0000000005011000-memory.dmp
          Download

          memory/3608-6-0x0000000005A60000-0x0000000005A61000-memory.dmp
          Download

          memory/4044-2-0x0000000000400000-0x0000000000428000-memory.dmp
          Download