Analysis
-
max time kernel
41s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 09:21
General
-
Target
SecuriteInfo.com.Artemis9384F39577D5.29456.exe
-
Size
1.4MB
-
MD5
9384f39577d50f51a122e2f3d1d875c0
-
SHA1
0628101eede7f441ec56217d0acee716b24a3ba0
-
SHA256
9787e886d7536b9343db7b8b78a9f87f5177b5d11460130d2aced11ccb44de8f
-
SHA512
882944adbe708490b28c4f15f43597e4760b819c040728f9dced69f9063cc08dd2e6b5bd45e00416a4f503cdfa3c994a9710f7a72eaf4735df18c14f893d05f9
Malware Config
Extracted
formbook
http://www.learnhour.net/eaud/
modshiro.com
mademarketingoss.com
austinjourls.info
wayupteam.com
crossingfinger.com
interseptors.com
gigashit.com
livetigo.com
halamankuningindonesia.com
windhammills.com
aylinahmet.com
mbacexonan.website
shopboxbarcelona.com
youyeslive.com
coonlinesportsbooks.com
guorunme.com
putlocker2.site
pencueaidnetwork.com
likevector.com
vulcanudachi-proclub.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis9384F39577D5.29456.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis9384F39577D5.29456.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis9384F39577D5.29456.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis9384F39577D5.29456.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis9384F39577D5.29456.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
468KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
340KB
-
Filesize
4KB
-
Filesize
160KB
-
-
Filesize
3.1MB