Analysis
- max time kernel
104s - max time network
107s - platform
windows10_x64 - resource
win10 - submitted
13/08/2020, 06:57
General
- Target 6605701.xls .exe
- Size 543KB
- Sample200813-2vdppdpqn2
- SHA256 62afb1cbcacb77aa2ca99cc55c0e3536738415289f53c4a3a57d9b9cc08ee5ab
Malware Config
Extracted
-
formbook
-
http://www.mage-cart.info/u4xn/
-
yanghl.com
-
decorvea.online
-
xn--fjq92bw28b1tloj5a39d42h.com
-
yumler.info
-
laketravisautosales.net
-
zjnrgx.info
-
harrimanpm.com
-
dell-yh.com
-
eze.fitness
-
pritpritzoom.com
-
hackgarage.com
-
mydomterry.net
-
castrotom.com
-
coffeecosplay.com
-
wsfg-hk.com
-
crystalbeachstudio.com
-
bestofreadbook.win
-
sutasz.info
-
yunfengyue.com
-
h11011.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 4 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6605701.xls .exe"C:\Users\Admin\AppData\Local\Temp\6605701.xls .exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v smgjygh /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Local\smgjy.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v smgjygh /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Local\smgjy.exe"3⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Local\smgjy.exe"C:\Users\Admin\AppData\Local\smgjy.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 1884⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1212-24-0x0000000000780000-0x00000000007A8000-memory.dmp
memory/1624-25-0x00000000040D0000-0x00000000040D1000-memory.dmp
memory/2928-3-0x00000000028A0000-0x00000000028BC000-memory.dmp
memory/2928-1-0x0000000000520000-0x0000000000521000-memory.dmp
memory/2928-6-0x0000000005820000-0x0000000005821000-memory.dmp
memory/2928-5-0x0000000005C40000-0x0000000005C41000-memory.dmp
memory/2928-0-0x0000000073150000-0x000000007383E000-memory.dmp
memory/3576-12-0x0000000073150000-0x000000007383E000-memory.dmp
memory/3576-20-0x0000000005F00000-0x0000000005F03000-memory.dmp