Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 07:10
General
-
Target
Shipping Document PL&BL Draft.exe
-
Size
322KB
-
MD5
a0614d41b6280e3f8bce2015eb4ba7aa
-
SHA1
ffe5c224de394e76c0a971d56576efb36e68aff9
-
SHA256
bcba31709cecf79a6996bda8b48a9e891db6de827c852404634a96d248560ba3
-
SHA512
eeb581210b8a20b9d5629170ea53a0f7157daf875489707ab6c894cab84aa244b65efa28dd62d81512a61acf64e7aadd2cedc529c4fd42b32b09a37020b23377
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/212-7-0x0000000000000000-mapping.dmp
-
memory/212-8-0x0000000000010000-0x000000000002F000-memory.dmpFilesize
124KB
-
memory/212-9-0x0000000000010000-0x000000000002F000-memory.dmpFilesize
124KB
-
memory/212-11-0x0000000006720000-0x0000000006891000-memory.dmpFilesize
1.4MB
-
memory/508-10-0x0000000000000000-mapping.dmp
-
memory/1832-2-0x0000000000000000-mapping.dmp
-
memory/2668-3-0x0000000000600000-0x0000000000629000-memory.dmpFilesize
164KB
-
memory/2668-4-0x000000000061D0E0-mapping.dmp