Overview

overview

10

Static

static

3b1d901412...3d.exe

windows7_x64

10

3b1d901412...3d.exe

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    14-01-2021 19:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3b1d9014124456eb0540384e0525563d.exe

  • Size

    712KB

  • MD5

    3b1d9014124456eb0540384e0525563d

  • SHA1

    52de9e2843933e5bbcb162a1083e168d787e1c44

  • SHA256

    4c2ffa57352cd1e3b76fdf01f581046245fe70427377823464857ad32189dcba

  • SHA512

    c4418339775e442cd0391bda22f6c77e751ec0f2e545129dea650b8ff23866be309f02eb894bec6e54d104510057014211b929a9d00cf5217e0d342f420dd911

Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.bodyfuelrtd.com/8rg4/

Decoy

fakecostasunglasses.com

twinbrothers.pizza

jizhoujsp.com

qscrit.com

hotelmanise.com

fer-ua.online

europserver-simcloud.systems

redwap2.pro

betwalkoffame.com

latashalovemillionaire.com

8million-lr.com

tomatrader.com

modaluxcutabovefitness.com

shishijiazu.com

cckytx.com

reversehomeloansmiami.com

imaginenationnetwork.com

thecyclistshop.com

jorgegiljewelry.com

hlaprotiens.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b1d9014124456eb0540384e0525563d.exe
    "C:\Users\Admin\AppData\Local\Temp\3b1d9014124456eb0540384e0525563d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\3b1d9014124456eb0540384e0525563d.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2016-7-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

    Download
  • memory/2016-8-0x000000000041D070-mapping.dmp
    Download
  • memory/2024-2-0x0000000074230000-0x000000007491E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2024-3-0x00000000008F0000-0x00000000008F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2024-5-0x0000000000320000-0x000000000032E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/2024-6-0x0000000005530000-0x00000000055BF000-memory.dmp
    Filesize

    572KB

    Download