Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report


General Information

Sample Name:shedfam.exe
Analysis ID:756041


Range:0 - 100


System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Uses netstat to query active network connections and open ports
Maps a DLL or memory area into another process
Performs DNS queries to domains with low reputation
Tries to detect virtualization through RDTSC time measurements
Sample uses process hollowing technique
Modifies the prolog of user mode functions (user mode inline hooks)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Queues an APC in another process (thread injection)
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Detected potential crypto function
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality to simulate keystroke presses
OS version to string mapping found (often used in BOTs)
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Contains functionality to retrieve information about pressed keystrokes
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Uses 32bit PE files
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to shutdown / reboot the system
Contains functionality to execute programs as a different user
Internet Provider seen in connection with other malware
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Contains functionality to communicate with device drivers
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Extensive use of GetProcAddress (often used to hide API calls)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to launch a program with higher privileges
Potential key logger detected (key state polling based)
Found evasive API chain (may stop execution after accessing registry keys)
Contains functionality to simulate mouse events
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)


  • System is w10x64
  • shedfam.exe (PID: 2620 cmdline: C:\Users\user\Desktop\shedfam.exe MD5: C0A85D86855B257B25572AA7D9D90381)
    • kmhbvf.exe (PID: 4820 cmdline: C:\Users\user\AppData\Local\Temp\kmhbvf.exe" "C:\Users\user\AppData\Local\Temp\wenvaisrl.au3 MD5: C56B5F0201A3B3DE53E561FE76912BFD)
      • kmhbvf.exe (PID: 5280 cmdline: C:\Users\user\AppData\Local\Temp\kmhbvf.exe" "C:\Users\user\AppData\Local\Temp\wenvaisrl.au3 MD5: C56B5F0201A3B3DE53E561FE76912BFD)
        • explorer.exe (PID: 3452 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
          • NETSTAT.EXE (PID: 2304 cmdline: C:\Windows\SysWOW64\NETSTAT.EXE MD5: 4E20FF629119A809BC0E7EE2D18A7FDB)
            • cmd.exe (PID: 5488 cmdline: /c del "C:\Users\user\AppData\Local\Temp\kmhbvf.exe" MD5: F3BDBE3BB6F734E357235F4D5898582D)
              • conhost.exe (PID: 5260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup
{"C2 list": ["www.justbeand.com/sk19/"], "decoy": ["21diasdegratitud.com", "kx1993.com", "chasergt.com", "837news.com", "naturagent.co.uk", "gatorinsurtech.com", "iyaboolashilesblog.africa", "jamtanganmurah.online", "gguminsa.com", "lilliesdrop.com", "lenvera.com", "link48.co.uk", "azinos777.fun", "lgcdct.cfd", "bg-gobtc.com", "livecarrer.uk", "cbq4u.com", "imalreadygone.com", "wabeng.africa", "jxmheiyouyuetot.tokyo", "atrikvde.xyz", "ceopxb.com", "autovincert.com", "18traversplace.com", "internetmedianews.com", "entersight.net", "guzmanshandymanservicesllc.com", "gqqwdz.com", "emeraldpathjewelery.com", "flowmoneycode.online", "gaziantepmedicalpointanket.com", "111lll.xyz", "irkwood138.site", "abovegross.com", "shopabeee.co.uk", "greenvalleyfoodusa.com", "dd-canada.com", "libertysminings.com", "baronsaccommodation.co.uk", "kareto.buzz", "freeexercisecoalition.com", "73129.vip", "avanteventexperiences.com", "comercialdiabens.fun", "nondescript.uk", "facal.dev", "detox-71934.com", "kovar.club", "jetsparking.com", "infocuspublicidad.com", "xxhcom.com", "indianvoltage.com", "becrownedllc.com", "3744palosverdes.com", "gospelnative.africa", "linkmastermind.com", "cotgfp.com", "lousweigman.com", "cantoaffine.online", "debbiepatrickdesigns.com", "766626.com", "webcubemedia.africa", "autonomaat.com", "hannahmarsh.co.uk"]}
0000000D.00000002.515105095.0000000002E10000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
    • 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    • 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
    0000000D.00000002.515105095.0000000002E10000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    0000000D.00000002.515105095.0000000002E10000.00000040.10000000.00040000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x18849:$sqlite3step: 68 34 1C 7B E1
    • 0x1895c:$sqlite3step: 68 34 1C 7B E1
    • 0x18878:$sqlite3text: 68 38 2A 90 C5
    • 0x1899d:$sqlite3text: 68 38 2A 90 C5
    • 0x1888b:$sqlite3blob: 68 53 D8 7F 8C
    • 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
    00000002.00000002.361815335.0000000000C70000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      Click to see the 34 entries
      2.0.kmhbvf.exe.400000.5.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security