Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
30/09/2022, 10:39
General
- Target فوری RFQ_AP65425652_032421,pdf.exe
- Size 474KB
- Sample220930-mpymmsecam
- SHA256 f89bda16cbe45d1a83fe2c107ae20b93f95f433c72b188cb76b8070073f25fc9
Malware Config
Extracted
-
formbook
-
nrln
-
IG7zJSm49UqTTuu/N/oTCIg=
-
CVLdAPgw0CRSMuZnRRU=
-
PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG
-
5i6p4GeQqtBgNRfGNQ==
-
5984keYswxh8mGZHz4ipAHtQ
-
VNJaK4Gh0CrOvHpW/p353A==
-
71rEtrL2icToyKGhcWrTxjsFU5T98zeO
-
r3q1sy1iZaL+2XIUAob7yw==
-
9+83Qkrk/vV/jVXsDvoTCIg=
-
aMFAgYF1prov8/UErH/Y1A==
-
Alqtx/0rxwEbCLdudftl
-
ImCbnglBSUHF0mv2tTSP40bPeYao
-
s4DFNvAJ4GIJ+g==
-
phOa6mtS8QQICuZnRRU=
-
7TSu5vqRtB45EZtf4WDSTBHPeYao
-
ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=
-
HF7jKjbGox2SAffTPw==
-
yAM3mOQot5l+cD0ikR5MGp8=
-
UYzW0/8z70JcQenVLidu1kLPeYao
-
OoCznp5UWz+hT9OBFXbfVhXPeYao
Extracted
-
xloader
-
3.8
-
nrln
-
IG7zJSm49UqTTuu/N/oTCIg=
-
CVLdAPgw0CRSMuZnRRU=
-
PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG
-
5i6p4GeQqtBgNRfGNQ==
-
5984keYswxh8mGZHz4ipAHtQ
-
VNJaK4Gh0CrOvHpW/p353A==
-
71rEtrL2icToyKGhcWrTxjsFU5T98zeO
-
r3q1sy1iZaL+2XIUAob7yw==
-
9+83Qkrk/vV/jVXsDvoTCIg=
-
aMFAgYF1prov8/UErH/Y1A==
-
Alqtx/0rxwEbCLdudftl
-
ImCbnglBSUHF0mv2tTSP40bPeYao
-
s4DFNvAJ4GIJ+g==
-
phOa6mtS8QQICuZnRRU=
-
7TSu5vqRtB45EZtf4WDSTBHPeYao
-
ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=
-
HF7jKjbGox2SAffTPw==
-
yAM3mOQot5l+cD0ikR5MGp8=
-
UYzW0/8z70JcQenVLidu1kLPeYao
-
OoCznp5UWz+hT9OBFXbfVhXPeYao
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\فوری RFQ_AP65425652_032421,pdf.exe"C:\Users\Admin\AppData\Local\Temp\فوری RFQ_AP65425652_032421,pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3056-141-0x00000000017B0000-0x00000000017C0000-memory.dmp
memory/3056-135-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3056-137-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3056-138-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3056-139-0x0000000000401000-0x000000000042F000-memory.dmp
memory/3056-140-0x0000000001890000-0x0000000001BDA000-memory.dmp
memory/3060-142-0x0000000008340000-0x00000000084B7000-memory.dmp
memory/3060-148-0x00000000031B0000-0x0000000003275000-memory.dmp
memory/3060-150-0x00000000031B0000-0x0000000003275000-memory.dmp
memory/4236-132-0x0000000000270000-0x00000000002E4000-memory.dmp
memory/4964-144-0x0000000001140000-0x000000000115E000-memory.dmp
memory/4964-146-0x0000000001A60000-0x0000000001DAA000-memory.dmp
memory/4964-145-0x0000000000DB0000-0x0000000000DDD000-memory.dmp
memory/4964-147-0x00000000017F0000-0x000000000187F000-memory.dmp
memory/4964-149-0x0000000000DB0000-0x0000000000DDD000-memory.dmp