Analysis
- max time kernel
150s - max time network
152s - platform
windows7_x64 - resource
win7v20201028 - submitted
19/01/2021, 06:28
General
- Target swift.05fd90a7-b0d0-49e8-9d15.exe
- Size 1.1MB
- Sample210119-49cexcgd4e
- SHA256 e79083b58aae06c0413f65d3979fcad177112e4f49ef3568d0b52392b07ff720
Malware Config
Extracted
-
formbook
-
http://www.wekrazy.com/ianv/
-
toysclass.com
-
baohiemthuduc.com
-
dronesracers.com
-
wallis-platform.com
-
waltermorgan.fitness
-
vsn-designs.com
-
cengjing.life
-
trackcatologueorders.com
-
newworkpay.com
-
brainywoodindia.com
-
myrtlebeachstripperstoyou.com
-
saori.cloud
-
10fastvpn.com
-
freemindsweden.com
-
phatsquares.com
-
pandemia.tienda
-
7560eads6.com
-
sabjidada.com
-
zhyingj.group
-
nailmanicurest.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/516-5-0x0000000000400000-0x0000000000428000-memory.dmp
memory/516-8-0x0000000000B30000-0x0000000000E33000-memory.dmp
memory/1864-2-0x00000000760B1000-0x00000000760B3000-memory.dmp
memory/1864-3-0x00000000020A0000-0x00000000020A1000-memory.dmp
memory/1864-4-0x00000000020A1000-0x00000000020A2000-memory.dmp