Overview

overview

10

Static

static

Packing li...in.exe

windows7_x64

10

Packing li...in.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    15-01-2021 07:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Packing list • Invoice • Country of origin.exe

  • Size

    377KB

  • MD5

    573ad7a8627f24f2e6fc4aa3c53f6328

  • SHA1

    2e292b7e6f41b0fd7dd31424989e5640f6e41e38

  • SHA256

    b4a9843d6c2869da17c9fb36d3aae7b869f3df444280943e07f3944f6408f086

  • SHA512

    750436f6da6c8daed66b61433789dc6a76a49bab86f2d5ef43434d9e77ed702ea5cc020981d9382b2ec8f1c0584d6600897efa67763e513a2569417e54222bc3

Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.4mzn-l1mit.com/x2ee/

Decoy

imarrawk.com

focusonyouwa.com

thedallygrind.com

hexa4shop.com

rebeccaroni.com

rocketmortgageliar.net

roomkoala.com

zewkr.com

gighomesale.com

xenonsunglasses.com

clqck.com

alittlereward.com

neuroeka.digital

gadgetsat.online

steigersteel.com

fsjdc.com

realnie-svingeri.site

directcare.pro

mo-kita.com

faxbbs.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 3 IoCs
    rat
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\Packing list • Invoice • Country of origin.exe
      "C:\Users\Admin\AppData\Local\Temp\Packing list • Invoice • Country of origin.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:532
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:1436
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\e3bc0ade3cf146ebb0444cf186a5e7a1.xml"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1316
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\e3bc0ade3cf146ebb0444cf186a5e7a1.xml"
            4⤵
            • Creates scheduled task(s)
            PID:908
        • C:\Users\Admin\AppData\Local\Temp\Packing list • Invoice • Country of origin.exe
          "C:\Users\Admin\AppData\Local\Temp\Packing list • Invoice • Country of origin.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1216
      • C:\Windows\SysWOW64\control.exe
        "C:\Windows\SysWOW64\control.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\Packing list • Invoice • Country of origin.exe"
          3⤵
          • Deletes itself
          PID:300

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\e3bc0ade3cf146ebb0444cf186a5e7a1.xml
      MD5

      a035055e1c80bc652520df45650c690f

      SHA1

      37b8364ad46e17199eb5a7ee89bb506bba384adb

      SHA256

      2b9948d34674d0fc0f9cb290da8298441b56205f6e341e3cfa1954df42c2b655

      SHA512

      678279d1bfc8a71c27a5a2c3afa5fd266882a62610863a3e4ebc2489f17827ed4c680c89e6b8b52621320500294d2df9888259ccdc5d38def43e739c1f325fc1

      Download Submit
    • memory/300-10-0x0000000000000000-mapping.dmp
      Download
    • memory/908-4-0x0000000000000000-mapping.dmp
      Download
    • memory/1216-6-0x000000000041D010-mapping.dmp
      Download
    • memory/1216-5-0x0000000000400000-0x0000000000428000-memory.dmp
      Filesize

      160KB

      Download
    • memory/1316-3-0x0000000000000000-mapping.dmp
      Download
    • memory/1436-2-0x0000000000000000-mapping.dmp
      Download
    • memory/1516-8-0x0000000000000000-mapping.dmp
      Download
    • memory/1516-9-0x00000000008C0000-0x00000000008DF000-memory.dmp
      Filesize

      124KB

      Download
    • memory/1516-11-0x00000000040D0000-0x0000000004224000-memory.dmp
      Filesize

      1.3MB

      Download