Analysis

  • max time kernel
    39s
  • max time network
    11s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    11-01-2021 18:21

General

  • Target

    c6a79aaad7ae2619ef0a38d08af79c83.exe

  • Size

    896KB

  • MD5

    c6a79aaad7ae2619ef0a38d08af79c83

  • SHA1

    8d6ef31473f3907846b532e5419bd5989375bb04

  • SHA256

    a7df5fff3eb06082036dd6634fa7c5022c48ae5438e5cff66bc500906c16597e

  • SHA512

    4074036556fb6b6a114173165cdb4dad324498b4d682e068ef42dff55cae52df8296e0699ecda1825e730b5642be136f181615b32eabb430760beba9eab5f7c6

Malware Config

Extracted

Family

formbook

C2

http://www.bodyfuelrtd.com/8rg4/

Decoy

fakecostasunglasses.com

twinbrothers.pizza

jizhoujsp.com

qscrit.com

hotelmanise.com

fer-ua.online

europserver-simcloud.systems

redwap2.pro

betwalkoffame.com

latashalovemillionaire.com

8million-lr.com

tomatrader.com

modaluxcutabovefitness.com

shishijiazu.com

cckytx.com

reversehomeloansmiami.com

imaginenationnetwork.com

thecyclistshop.com

jorgegiljewelry.com

hlaprotiens.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6a79aaad7ae2619ef0a38d08af79c83.exe
    "C:\Users\Admin\AppData\Local\Temp\c6a79aaad7ae2619ef0a38d08af79c83.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Admin\AppData\Local\Temp\c6a79aaad7ae2619ef0a38d08af79c83.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/460-8-0x000000000041D070-mapping.dmp
  • memory/460-7-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1936-2-0x0000000073E00000-0x00000000744EE000-memory.dmp
    Filesize

    6.9MB

  • memory/1936-3-0x0000000000E50000-0x0000000000E51000-memory.dmp
    Filesize

    4KB

  • memory/1936-5-0x0000000000210000-0x000000000021E000-memory.dmp
    Filesize

    56KB

  • memory/1936-6-0x0000000005400000-0x0000000005495000-memory.dmp
    Filesize

    596KB