Overview

overview

10

Static

static

swift.05fd...15.exe

windows7_x64

10

swift.05fd...15.exe

windows10_x64

10

Analysis

  • max time kernel
    73s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-01-2021 06:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    swift.05fd90a7-b0d0-49e8-9d15.exe

  • Size

    1.1MB

  • MD5

    b8d1d81917069e3cdf34088836efe9c0

  • SHA1

    b7161586fa8437a6bdf0d3a15c831d35b0f0e262

  • SHA256

    e79083b58aae06c0413f65d3979fcad177112e4f49ef3568d0b52392b07ff720

  • SHA512

    e116f728f36e09cd325a8617668d434db555cffa4282dba96591afa974f4c79bb0385922677eb67945c98b3508648397b1af16041388c7224cb1ebbf9a7f5e72

Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.wekrazy.com/ianv/

Decoy

toysclass.com

baohiemthuduc.com

dronesracers.com

wallis-platform.com

waltermorgan.fitness

vsn-designs.com

cengjing.life

trackcatologueorders.com

newworkpay.com

brainywoodindia.com

myrtlebeachstripperstoyou.com

saori.cloud

10fastvpn.com

freemindsweden.com

phatsquares.com

pandemia.tienda

7560eads6.com

sabjidada.com

zhyingj.group

nailmanicurest.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe
    "C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe
      "C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"
      2⤵
        PID:3188
      • C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe
        "C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1004

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1004-4-0x0000000000400000-0x0000000000428000-memory.dmp
      Filesize

      160KB

      Download
    • memory/1004-5-0x000000000041D040-mapping.dmp
      Download
    • memory/1004-7-0x0000000001620000-0x0000000001940000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/3976-2-0x00000000024A0000-0x00000000024A1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3976-3-0x00000000024A1000-0x00000000024A2000-memory.dmp
      Filesize

      4KB

      Download