Overview

overview

10

Static

static

new purcha...85.exe

windows7_x64

10

new purcha...85.exe

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    115s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    04/08/2020, 13:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    new purchase order No 0696846238 9684753285.exe
  • Size 876KB
  • Sample200804-anxfs63fds
  • SHA256 9d9739b817d35a815e89c74d8e04d1571e5591de09ca6e8d7a634b140db45605
  • MD5 SHA1 SHA512
Score
10/10
ratpersistencetrojanspywarestealerformbook

Malware Config

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Formbook Payload 3 IoCs
    rat

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2972
    • C:\Users\Admin\AppData\Local\Temp\new purchase order No 0696846238 9684753285.exe
      "C:\Users\Admin\AppData\Local\Temp\new purchase order No 0696846238 9684753285.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Modifies system certificate store
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      PID:3588
      • C:\Users\Admin\AppData\Local\Temp\new purchase order No 0696846238 9684753285.exe
        "C:\Users\Admin\AppData\Local\Temp\new purchase order No 0696846238 9684753285.exe"
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3948

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3948-0-0x0000000000400000-0x0000000000428000-memory.dmp
        Download