Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-01-2021 18:15
General
-
Target
Shipping Documents PL&BL Draft.scr
-
Size
449KB
-
MD5
683ec5541b3901533bf82d5df00dcde2
-
SHA1
c3dc36ffb0efaf7aad512b8a82c43678b7314f38
-
SHA256
040e512b75bacd0ed6e0e13efa13f6ea92ebd47c214112b5371425009909c842
-
SHA512
f17861a053bb7646911aa3b9b67b5918c6cefd09a91e28cb11fd2a6d549f4e279ca345403e0e32f9ed6a3b15c29fb2a25a885b4bb845d42c8b8dbfad47165134
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr"C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr"C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr" /S3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1928-2-0x000000000061D0E0-mapping.dmp
-
memory/1928-4-0x0000000000260000-0x0000000000270000-memory.dmpFilesize
64KB
-
memory/1928-3-0x0000000000A30000-0x0000000000D50000-memory.dmpFilesize
3.1MB
-
memory/2200-6-0x0000000000000000-mapping.dmp
-
memory/2200-7-0x0000000000CF0000-0x0000000000D0E000-memory.dmpFilesize
120KB
-
memory/2200-8-0x0000000000980000-0x00000000009A9000-memory.dmpFilesize
164KB
-
memory/2200-9-0x0000000003320000-0x0000000003640000-memory.dmpFilesize
3.1MB
-
memory/2200-13-0x00000000030E0000-0x000000000316F000-memory.dmpFilesize
572KB
-
memory/3036-5-0x00000000053F0000-0x0000000005546000-memory.dmpFilesize
1.3MB
-
memory/3036-14-0x0000000002C20000-0x0000000002CBD000-memory.dmpFilesize
628KB
-
memory/3144-10-0x0000000000000000-mapping.dmp