Analysis
- max time kernel
129s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/02/2021, 22:55
General
- Target SecuriteInfo.com.Backdoor.MSIL.NanoBot.RKCMTB.20692.exe
- Size 655KB
- Sample210212-3gs4vd63ta
- SHA256 b8392aaf409d89fe323576fdf09bf3320094962da9812918d23bb47b3d8d53f8
Malware Config
Extracted
-
formbook
-
http://www.trucktiresdirect.net/qef6/
-
jlfloridahomes.com
-
analogmedia.art
-
hechicerodelamor.club
-
nmsu.red
-
sintranature.com
-
anaclisis.com
-
familypreparednessplans.com
-
kbsvipbags.com
-
matthassett.com
-
opentablenetwork.com
-
wocoal.com
-
about-central.com
-
biggamesquaresonline.com
-
daramanzel.com
-
voicehumo.info
-
freedomfoee.com
-
shopendora.com
-
crditreports.com
-
dynamicls.com
-
thebot.win
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Backdoor.MSIL.NanoBot.RKCMTB.20692.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Backdoor.MSIL.NanoBot.RKCMTB.20692.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Backdoor.MSIL.NanoBot.RKCMTB.20692.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Backdoor.MSIL.NanoBot.RKCMTB.20692.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1628-2-0x0000000073840000-0x0000000073F2E000-memory.dmp
memory/1628-3-0x0000000000F50000-0x0000000000F51000-memory.dmp
memory/1628-5-0x00000000059C0000-0x00000000059C1000-memory.dmp
memory/1628-6-0x0000000005FD0000-0x0000000005FD1000-memory.dmp
memory/1628-7-0x0000000005AD0000-0x0000000005AD1000-memory.dmp
memory/1628-8-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/1628-9-0x0000000003400000-0x0000000003401000-memory.dmp
memory/1628-10-0x0000000005C30000-0x0000000005C31000-memory.dmp
memory/1628-11-0x0000000003460000-0x0000000003464000-memory.dmp
memory/1628-12-0x00000000017A0000-0x00000000017F7000-memory.dmp
memory/3208-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3208-16-0x0000000000F00000-0x0000000001220000-memory.dmp