Analysis
-
max time kernel
150s -
max time network
53s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-01-2021 18:09
General
-
Target
Scan Document 01.exe
-
Size
435KB
-
MD5
47a3b1f5f7a8f5d342654a4e351d62ea
-
SHA1
e94eca6012b651847bfb4212c21c989041d1438e
-
SHA256
196b4470cd98c4f6d5c634170a1c6a98cf59b61c9b12a032ec9fb776b74a0527
-
SHA512
d4f4b0064830a0091a9ed070f9e43c0abb768d1fc4bf6d5a9589f2ce3b4a0908125264233a53119c914994474a30f628c04fbdb0361d2e8556094caebb0e303e
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 2 IoCs
-
Deletes itself 1 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 118 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 116 IoCs
-
Suspicious use of SendNotifyMessage 116 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"5⤵
- Deletes itself
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/676-11-0x0000000000000000-mapping.dmp
-
memory/1020-2-0x00000000753E1000-0x00000000753E3000-memory.dmpFilesize
8KB
-
memory/1200-7-0x0000000003F30000-0x000000000400F000-memory.dmpFilesize
892KB
-
memory/1200-16-0x0000000006340000-0x0000000006415000-memory.dmpFilesize
852KB
-
memory/1200-9-0x0000000007110000-0x000000000728A000-memory.dmpFilesize
1.5MB
-
memory/1264-12-0x0000000001420000-0x000000000143B000-memory.dmpFilesize
108KB
-
memory/1264-10-0x0000000000000000-mapping.dmp
-
memory/1264-13-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1264-14-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/1264-15-0x0000000000D30000-0x0000000000DBF000-memory.dmpFilesize
572KB
-
memory/1508-8-0x0000000000520000-0x0000000000530000-memory.dmpFilesize
64KB
-
memory/1508-6-0x00000000003D0000-0x00000000003E0000-memory.dmpFilesize
64KB
-
memory/1508-4-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1508-5-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1508-3-0x000000000041D0E0-mapping.dmp
-
memory/1688-17-0x0000000000000000-mapping.dmp
-
memory/1688-18-0x000007FEFB571000-0x000007FEFB573000-memory.dmpFilesize
8KB
-
memory/1688-19-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB