Analysis
-
max time kernel
126s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:55
General
-
Target
SWIFT Payment DOOEL EUR 74,246.41 20210101950848.exe
-
Size
895KB
-
MD5
b8ead540e40416915bd3f6134f2017bb
-
SHA1
e74cf3642e4bd4b3f616bc5230edd5312d97ecfc
-
SHA256
201f068c15e749ce1d3bd1a8e48909a9b0e8e5b0774b0eb2abc9096449fdbe67
-
SHA512
1e5631249b531d0abf6f3603016ec1e06d3efe55bae91c8db116ab5c94f126473448bf78338163a8cbc526bb168d70933014222150afbb9270a08303f0963002
Malware Config
Extracted
formbook
http://www.boundlesshealthyliving.com/isub/
beeyoubc.net
nimbleangel.com
woninghuurcuracao.com
hair2dye4.academy
affordablebothell.com
maglex.info
jacykretas.com
toushiys.com
gfitzfreetestcloud.com
sisuluzinterior.com
sunshipinvestments.com
lulenahairco.com
shangchen33.com
ocase24.com
shamanicsound.com
newbharatbakery.com
imratingit.net
twinningtreats.com
btzmed.com
bedtimewish.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\SWIFT Payment DOOEL EUR 74,246.41 20210101950848.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT Payment DOOEL EUR 74,246.41 20210101950848.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SWIFT Payment DOOEL EUR 74,246.41 20210101950848.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT Payment DOOEL EUR 74,246.41 20210101950848.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.1MB
-
-
Filesize
1.1MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
388KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB