Analysis

  • max time kernel
    149s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    23-02-2021 12:54

General

  • Target

    0O9BJfVJi6fEMoS.exe

  • Size

    797KB

  • MD5

    18ec78e09155c046a203fb4dcbc3593f

  • SHA1

    40e67eef7c001a8752763616fc9a58170721c27a

  • SHA256

    01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0

  • SHA512

    28801c6b546515f4fb67f199f70b160dffb41434bcb465f92d3f20dbad698194f162b443571ea267a1dd7c7ef0bcaf4bb82116c37d3a83433f9d3de28083234e

Malware Config

Extracted

Family

formbook

C2

http://www.besteprobioticakopen.online/uszn/

Decoy

animegriptape.com

pcpnetworks.com

putupmybabyforadoption.com

xn--jvrr98g37n88d.com

fertinvitro.doctor

undonethread.com

avoleague.com

sissysundays.com

guilhermeoliveiro.site

catholicon-bespeckle.info

mardesuenosfundacion.com

songkhoe24.site

shoecityindia.com

smallbathroomdecor.info

tskusa.com

prairiespringsllc.com

kegncoffee.com

clicklounge.xyz

catholicendoflifeplanning.com

steelobzee.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Users\Admin\AppData\Local\Temp\0O9BJfVJi6fEMoS.exe
      "C:\Users\Admin\AppData\Local\Temp\0O9BJfVJi6fEMoS.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1924
      • C:\Users\Admin\AppData\Local\Temp\0O9BJfVJi6fEMoS.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1068
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Gathers network information
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:820
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\0O9BJfVJi6fEMoS.exe"
        3⤵
        • Deletes itself
        PID:944

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/820-14-0x0000000000000000-mapping.dmp
  • memory/820-20-0x0000000000A20000-0x0000000000AAF000-memory.dmp
    Filesize

    572KB

  • memory/820-19-0x0000000002150000-0x0000000002453000-memory.dmp
    Filesize

    3.0MB

  • memory/820-18-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

  • memory/820-17-0x0000000000D40000-0x0000000000D4A000-memory.dmp
    Filesize

    40KB

  • memory/820-15-0x0000000075AE1000-0x0000000075AE3000-memory.dmp
    Filesize

    8KB

  • memory/944-16-0x0000000000000000-mapping.dmp
  • memory/1068-12-0x00000000000F0000-0x0000000000100000-memory.dmp
    Filesize

    64KB

  • memory/1068-11-0x0000000000990000-0x0000000000C93000-memory.dmp
    Filesize

    3.0MB

  • memory/1068-9-0x000000000041D0F0-mapping.dmp
  • memory/1068-8-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1276-13-0x0000000003CD0000-0x0000000003D81000-memory.dmp
    Filesize

    708KB

  • memory/1924-2-0x00000000742C0000-0x00000000749AE000-memory.dmp
    Filesize

    6.9MB

  • memory/1924-7-0x0000000004D60000-0x0000000004DB6000-memory.dmp
    Filesize

    344KB

  • memory/1924-6-0x00000000002D0000-0x00000000002DB000-memory.dmp
    Filesize

    44KB

  • memory/1924-5-0x0000000004D20000-0x0000000004D21000-memory.dmp
    Filesize

    4KB

  • memory/1924-3-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
    Filesize

    4KB