Analysis
- max time kernel
149s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/01/2021, 10:14
General
- Target Invoice Payment Details.exe
- Size 892KB
- Sample210119-c9v21mqtyj
- SHA256 a55e49e3dffd386fbe1b8cfdafb4bcca81264b48e1fa2f9d68a7b8b12ec2bc7e
Malware Config
Extracted
-
formbook
-
http://www.smallcoloradoweddings.com/kio8/
-
greeaircondition.com
-
thewilmingtonguide.com
-
cbluedotlivewdmall.com
-
globalcrime24.com
-
heightsplace.com
-
ghar.pro
-
asosbira.com
-
melolandia.com
-
velactun.com
-
erniesimms.com
-
nutbullet.com
-
drizzerstr.com
-
hnqym888.com
-
ghorowaseba.com
-
1317efoxchasedrive.info
-
stjudetroop623.com
-
facestaj.com
-
airpromaskaccessories.com
-
wolfetailors.com
-
56ohdc2016.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice Payment Details.exe"C:\Users\Admin\AppData\Local\Temp\Invoice Payment Details.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice Payment Details.exe"C:\Users\Admin\AppData\Local\Temp\Invoice Payment Details.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Invoice Payment Details.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/836-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/836-17-0x0000000001030000-0x0000000001040000-memory.dmp
memory/836-16-0x0000000001050000-0x0000000001370000-memory.dmp
memory/1192-8-0x0000000005650000-0x0000000005651000-memory.dmp
memory/1192-3-0x0000000000940000-0x0000000000941000-memory.dmp
memory/1192-10-0x0000000005660000-0x0000000005661000-memory.dmp
memory/1192-11-0x00000000056C0000-0x00000000056E3000-memory.dmp
memory/1192-12-0x0000000006140000-0x00000000061A1000-memory.dmp
memory/1192-2-0x0000000073A70000-0x000000007415E000-memory.dmp
memory/1192-7-0x0000000005460000-0x0000000005461000-memory.dmp
memory/1192-6-0x0000000005960000-0x0000000005961000-memory.dmp
memory/1192-5-0x00000000053C0000-0x00000000053C1000-memory.dmp
memory/1192-9-0x0000000005370000-0x0000000005371000-memory.dmp
memory/2588-18-0x0000000005820000-0x0000000005951000-memory.dmp
memory/2588-26-0x0000000001290000-0x0000000001355000-memory.dmp
memory/2732-20-0x00000000008F0000-0x00000000008FB000-memory.dmp
memory/2732-21-0x0000000002CE0000-0x0000000002D09000-memory.dmp
memory/2732-22-0x0000000003450000-0x0000000003770000-memory.dmp
memory/2732-25-0x00000000032C0000-0x000000000334F000-memory.dmp