Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 09:05
General
-
Target
Shipping Document PL&BL Draft.exe
-
Size
467KB
-
MD5
dd56b21e6b3a1a0958885059d6a395d2
-
SHA1
01ba3635bb6776ef50ad57c206cf674d69e8e61c
-
SHA256
e7091e7da366f0b1d4acbc1295841c6f7d1ab9412a9fe3fd9341c9d94274c457
-
SHA512
dccf3a92be410b7a0f20342c73c2e935975eecf3bb23c3dac69aaa91ff4e944593c3f4cfd2dc8e751c9c042089028affa9bfbacc4474c5adc0b19622232ed1b5
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3108-7-0x0000000006DC0000-0x0000000006E7A000-memory.dmpFilesize
744KB
-
memory/3108-14-0x00000000058D0000-0x0000000005A52000-memory.dmpFilesize
1.5MB
-
memory/3808-8-0x0000000000000000-mapping.dmp
-
memory/3808-9-0x0000000001320000-0x0000000001326000-memory.dmpFilesize
24KB
-
memory/3808-10-0x0000000000480000-0x00000000004A9000-memory.dmpFilesize
164KB
-
memory/3808-12-0x0000000000EB0000-0x00000000011D0000-memory.dmpFilesize
3.1MB
-
memory/3808-13-0x0000000000D70000-0x0000000000DFF000-memory.dmpFilesize
572KB
-
memory/4120-2-0x000000000041D0E0-mapping.dmp
-
memory/4120-4-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4120-6-0x0000000000FA0000-0x0000000000FB0000-memory.dmpFilesize
64KB
-
memory/4120-5-0x0000000001200000-0x0000000001520000-memory.dmpFilesize
3.1MB
-
memory/4188-11-0x0000000000000000-mapping.dmp