Analysis
- max time kernel
147s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
25/02/2021, 14:19
General
- Target dwg.exe
- Size 96KB
- Sample210225-d8cr642gpn
- SHA256 6f33f5e3a23420dacdc26fb8e2eef07fe482e634d4b832b0917cbe7ed37864f5
Malware Config
Extracted
-
formbook
-
http://www.karatetheokinawaway.com/gzjz/
-
manayir.com
-
resp04.online
-
readingqueens.com
-
guillemaudexcellenceauto.com
-
chaing-list.xyz
-
ibluebay3dwd.com
-
scriptureonhealing.com
-
bcmsglobal.com
-
neuroacademyok.com
-
serotoninisle.com
-
process-activation.net
-
salsashacks.com
-
hetxat.com
-
fileready.xyz
-
www744676.com
-
youridealworld.com
-
learningadvisers.com
-
dmzcjk.com
-
apkiinsurance.com
-
ouvrirunrestaurant.academy
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwg.exe"C:\Users\Admin\AppData\Local\Temp\dwg.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dwg.exe"C:\Users\Admin\AppData\Local\Temp\dwg.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\dwg.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/808-6-0x0000000000401000-0x00000000004FD000-memory.dmp
memory/808-7-0x0000000000560000-0x0000000000660000-memory.dmp
memory/808-8-0x0000000000401000-0x0000000000541000-memory.dmp
memory/808-9-0x000000001E310000-0x000000001E630000-memory.dmp
memory/808-10-0x000000001E280000-0x000000001E290000-memory.dmp
memory/1456-4-0x0000000002AA0000-0x0000000002AAB000-memory.dmp
memory/1456-3-0x00000000004C0000-0x00000000004C1000-memory.dmp
memory/2112-16-0x00000000034D0000-0x00000000037F0000-memory.dmp
memory/2112-15-0x0000000000DC0000-0x0000000000DE9000-memory.dmp
memory/2112-14-0x00000000014B0000-0x00000000014CE000-memory.dmp
memory/2112-17-0x00000000037F0000-0x000000000387F000-memory.dmp
memory/3024-11-0x0000000006830000-0x0000000006973000-memory.dmp
memory/3024-18-0x0000000002810000-0x00000000028CC000-memory.dmp