Analysis
- max time kernel
147s - max time network
133s - platform
windows10_x64 - resource
win10 - submitted
13/08/2020, 03:20
General
- Target order inquiry.exe
- Size 417KB
- Sample200813-8yprrnab7x
- SHA256 3df6c5354d1899b7249078b6aec00872710092c2328c0a3e20c79409f42adad4
Malware Config
Extracted
-
formbook
-
http://www.funpexw.com/wba/
-
xiangxcongc.com
-
porttoken.com
-
migorganicsoap.com
-
askcoo.com
-
retiremerana.com
-
justinbible.com
-
landscapingcanberra.com
-
cannabiscapitaljournal.com
-
ycsfjx.com
-
xgwl555.com
-
ebc.group
-
studglasses.com
-
650358.com
-
quliancheba.com
-
disizmi.com
-
haomabaidu.com
-
bildungimdialog.com
-
fomoonline.com
-
transitionsales.com
-
isfxzm.men
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 4 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Program Files directory 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 37 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\order inquiry.exe"C:\Users\Admin\AppData\Local\Temp\order inquiry.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1780-22-0x00007FF7ADB50000-0x00007FF7ADBE3000-memory.dmp
memory/1780-21-0x00007FF7ADB50000-0x00007FF7ADBE3000-memory.dmp
memory/1780-20-0x00007FF7ADB50000-0x00007FF7ADBE3000-memory.dmp
memory/3100-6-0x00000000051C0000-0x00000000051C3000-memory.dmp
memory/3100-3-0x00000000027C0000-0x00000000027CF000-memory.dmp
memory/3100-1-0x0000000000460000-0x0000000000461000-memory.dmp
memory/3100-0-0x0000000073A70000-0x000000007415E000-memory.dmp
memory/3100-5-0x00000000054E0000-0x00000000054E1000-memory.dmp
memory/3100-4-0x0000000005900000-0x0000000005901000-memory.dmp
memory/3460-11-0x0000000001010000-0x0000000001029000-memory.dmp
memory/3460-12-0x0000000001010000-0x0000000001029000-memory.dmp
memory/3460-15-0x0000000005850000-0x000000000597A000-memory.dmp
memory/3460-18-0x0000000006320000-0x000000000644F000-memory.dmp
memory/3952-7-0x0000000000400000-0x000000000042D000-memory.dmp