Analysis
- max time kernel
61s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
29/01/2021, 08:48
General
- Target 2b72bc4ba9645af5482661c5d1d1c7f8.exe
- Size 892KB
- Sample210129-8e7j23tfbs
- SHA256 b3291d1f731c8e7408bbae7e36242e7223d24d7b3ef0fa2b7f07950be8dd3462
Malware Config
Extracted
-
formbook
-
http://www.inreachpt.com/gqx2/
-
calusaptamiami.com
-
starlinkwebservices.com
-
lakeviewbarbershonola.com
-
oaklandraidersjerseyspop.com
-
ohiotechreport.com
-
eligetucafetera.com
-
tu4343.com
-
abstract-elearning.com
-
thebabylashes.com
-
athleteshive.com
-
fanninhomesforless.com
-
sembracna.com
-
servicesyn.com
-
bellairechoice.com
-
tmpaas.com
-
eyepaa.com
-
stickerzblvd.com
-
rentfs.com
-
nadya-shanab.com
-
microwgreens.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b72bc4ba9645af5482661c5d1d1c7f8.exe"C:\Users\Admin\AppData\Local\Temp\2b72bc4ba9645af5482661c5d1d1c7f8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2b72bc4ba9645af5482661c5d1d1c7f8.exe"C:\Users\Admin\AppData\Local\Temp\2b72bc4ba9645af5482661c5d1d1c7f8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/636-2-0x0000000073190000-0x000000007387E000-memory.dmp
memory/636-3-0x00000000002B0000-0x00000000002B1000-memory.dmp
memory/636-5-0x0000000004C90000-0x0000000004C91000-memory.dmp
memory/636-6-0x0000000005330000-0x0000000005331000-memory.dmp
memory/636-7-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/636-8-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/636-9-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/636-10-0x0000000005000000-0x0000000005001000-memory.dmp
memory/636-11-0x0000000005830000-0x0000000005831000-memory.dmp
memory/636-12-0x0000000004FA0000-0x0000000004FA3000-memory.dmp
memory/636-13-0x0000000005DE0000-0x0000000005E3B000-memory.dmp
memory/1928-14-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1928-17-0x00000000019E0000-0x0000000001D00000-memory.dmp