Overview

overview

10

Static

static

10

qkuriw.jpg.exe

windows7_x64

6

qkuriw.jpg.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    31-07-2020 10:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    qkuriw.jpg.exe

  • Size

    182KB

  • MD5

    7af33570ec886974f5513b46e999b988

  • SHA1

    6b9e35f3131fdc4bd8ea66cd44303cb1004b2019

  • SHA256

    da4647425789cc5a32d2719815367c8c21d2279a77a3179e609e1db9844ef15a

  • SHA512

    2c8cd12d2ed3f0e62358e696115d6422fa808c89dee0b9d0f157b54806d4796f84d7a7b0208a6c295cf368d777d2ad83a9908d2137842c749d6807bc926265d7

Score
10/10
ratspywaretrojanstealerformbook

Malware Config

Signatures

  • Suspicious use of SendNotifyMessage 1 IoCs
  • Formbook Payload 1 IoCs
    rat
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of AdjustPrivilegeToken
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\qkuriw.jpg.exe
      "C:\Users\Admin\AppData\Local\Temp\qkuriw.jpg.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetThreadContext
      PID:3612
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\SysWOW64\mstsc.exe"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetThreadContext
      PID:3940
      • C:\Windows\SysWOW64\cmd.exe
        /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
        3⤵
          PID:3896
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:3760

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\DB1
        Download Submit
      • C:\Users\Admin\AppData\Roaming\419RB7D7\419logim.jpeg
        Download Submit
      • C:\Users\Admin\AppData\Roaming\419RB7D7\419logrf.ini
        Download Submit
      • C:\Users\Admin\AppData\Roaming\419RB7D7\419logrg.ini
        Download Submit
      • C:\Users\Admin\AppData\Roaming\419RB7D7\419logri.ini
        Download Submit
      • C:\Users\Admin\AppData\Roaming\419RB7D7\419logrv.ini
        Download Submit
      • memory/2988-6-0x00000000053F0000-0x0000000005569000-memory.dmp
        Filesize

        1.5MB

        Download
      • memory/3760-8-0x0000000000000000-mapping.dmp
        Download
      • memory/3760-9-0x00007FF617570000-0x00007FF617603000-memory.dmp
        Filesize

        588KB

        Download
      • memory/3760-10-0x00007FF617570000-0x00007FF617603000-memory.dmp
        Filesize

        588KB

        Download
      • memory/3760-11-0x00007FF617570000-0x00007FF617603000-memory.dmp
        Filesize

        588KB

        Download
      • memory/3896-4-0x0000000000000000-mapping.dmp
        Download
      • memory/3940-7-0x0000000006470000-0x0000000006506000-memory.dmp
        Filesize

        600KB

        Download
      • memory/3940-1-0x0000000000000000-mapping.dmp
        Download
      • memory/3940-3-0x00000000013C0000-0x00000000016BC000-memory.dmp
        Filesize

        3.0MB

        Download
      • memory/3940-2-0x00000000013C0000-0x00000000016BC000-memory.dmp
        Filesize

        3.0MB

        Download