Analysis
- max time kernel
73s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/01/2021, 06:28
General
- Target swift.05fd90a7-b0d0-49e8-9d15.exe
- Size 1.1MB
- Sample210119-49cexcgd4e
- SHA256 e79083b58aae06c0413f65d3979fcad177112e4f49ef3568d0b52392b07ff720
Score
10/10
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.wekrazy.com/ianv/
Decoy
-
toysclass.com
-
baohiemthuduc.com
-
dronesracers.com
-
wallis-platform.com
-
waltermorgan.fitness
-
vsn-designs.com
-
cengjing.life
-
trackcatologueorders.com
-
newworkpay.com
-
brainywoodindia.com
-
myrtlebeachstripperstoyou.com
-
saori.cloud
-
10fastvpn.com
-
freemindsweden.com
-
phatsquares.com
-
pandemia.tienda
-
7560eads6.com
-
sabjidada.com
-
zhyingj.group
-
nailmanicurest.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1004-4-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1004-7-0x0000000001620000-0x0000000001940000-memory.dmp
memory/3976-2-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3976-3-0x00000000024A1000-0x00000000024A2000-memory.dmp