Overview

overview

10

Static

static

SecuriteIn...49.exe

windows7_x64

10

SecuriteIn...49.exe

windows10_x64

10

Analysis

  • max time kernel
    57s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    29/01/2021, 11:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Trojan.PackedNET.524.22310.8249.exe
  • Size 1.1MB
  • Sample210129-d67zzywehn
  • SHA256 6ceed0880cf4e6861ae894331beef85274f7f6a3f8dbc19d4a5f4e41b239439e
  • MD5 SHA1 SHA512
Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.classifoods.com/oean/

Decoy

  • keboate.club

  • whitehatiq.com

  • loimtech.com

  • icaroagencia.com

  • snigglez.com

  • noreservationsxpress.com

  • villacascabel.com

  • 5037adairway.com

  • growingequity.fund

  • stafffully.com

  • bingent.info

  • tmssaleguarantee.com

  • neonatalfeedrates.com

  • george-beauty.com

  • oraghallaighjourney.net

  • zunutrition.com

  • sylkysmooveentertainment.com

  • ddmns6tzey2d.com

  • dvcstay.com

  • 304shaughnessygreen.info

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.524.22310.8249.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.524.22310.8249.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.524.22310.8249.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.524.22310.8249.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:316

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/316-8-0x0000000000400000-0x0000000000428000-memory.dmp
        Download

        memory/316-11-0x00000000009C0000-0x0000000000CC3000-memory.dmp
        Download

        memory/1852-2-0x0000000074840000-0x0000000074F2E000-memory.dmp
        Download

        memory/1852-3-0x0000000010620000-0x0000000010621000-memory.dmp
        Download

        memory/1852-5-0x0000000000450000-0x0000000000453000-memory.dmp
        Download

        memory/1852-6-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
        Download

        memory/1852-7-0x00000000053D0000-0x0000000005466000-memory.dmp
        Download