Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 07:03
General
-
Target
Shipping Documents PL&BL Draft.scr
-
Size
449KB
-
MD5
683ec5541b3901533bf82d5df00dcde2
-
SHA1
c3dc36ffb0efaf7aad512b8a82c43678b7314f38
-
SHA256
040e512b75bacd0ed6e0e13efa13f6ea92ebd47c214112b5371425009909c842
-
SHA512
f17861a053bb7646911aa3b9b67b5918c6cefd09a91e28cb11fd2a6d549f4e279ca345403e0e32f9ed6a3b15c29fb2a25a885b4bb845d42c8b8dbfad47165134
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr"C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr"C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr" /S3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2752-2-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2752-3-0x000000000041D0E0-mapping.dmp
-
memory/3372-8-0x0000000000000000-mapping.dmp
-
memory/4016-6-0x0000000000C90000-0x0000000000E03000-memory.dmpFilesize
1.4MB
-
memory/4016-5-0x0000000000000000-mapping.dmp
-
memory/4016-7-0x0000000000C90000-0x0000000000E03000-memory.dmpFilesize
1.4MB