Analysis
- max time kernel
146s - max time network
136s - platform
windows10_x64 - resource
win10v200722 - submitted
17/08/2020, 07:04
General
- Target DOC99281270.exe
- Size 477KB
- Sample200817-1sqj67m2d2
- SHA256 2a6f4ceccb614247724bff7ecc0241c756b3d0d971734ebf7d15d2c822975ff1
Malware Config
Extracted
-
formbook
-
http://www.flekcht.com/crb/
-
rghandicraft.com
-
miamiexpressservice.com
-
spicycenter.com
-
tool-kit.info
-
helpinghandcleanersllc.com
-
ailink.network
-
boosterpub.com
-
heysever.us
-
fanhush.com
-
extremelyrobust.com
-
energyslides.com
-
fitflopsoutletstore.us
-
torellys.com
-
thatsigns.com
-
promotionproduct.ltd
-
riskynihali.com
-
sozialesnetz.online
-
fotoindia3.com
-
oxydj.info
-
dsgvocc.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Program Files directory 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DOC99281270.exe"C:\Users\Admin\AppData\Local\Temp\DOC99281270.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DOC99281270.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DOC99281270.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2444-10-0x0000000000400000-0x000000000042D000-memory.dmp
memory/2516-19-0x0000000006120000-0x0000000006280000-memory.dmp
memory/2516-16-0x0000000005490000-0x000000000553F000-memory.dmp
memory/2516-13-0x0000000000080000-0x0000000000096000-memory.dmp
memory/2516-14-0x0000000000080000-0x0000000000096000-memory.dmp
memory/3776-8-0x0000000008800000-0x0000000008850000-memory.dmp
memory/3776-5-0x0000000007CC0000-0x0000000007CC1000-memory.dmp
memory/3776-1-0x0000000000E90000-0x0000000000E91000-memory.dmp
memory/3776-0-0x00000000738E0000-0x0000000073FCE000-memory.dmp
memory/3776-7-0x0000000007CD0000-0x0000000007CD4000-memory.dmp
memory/3776-3-0x0000000008020000-0x0000000008021000-memory.dmp
memory/3776-4-0x0000000007C10000-0x0000000007C11000-memory.dmp
memory/3776-9-0x0000000003160000-0x000000000318E000-memory.dmp
memory/3776-6-0x0000000007EF0000-0x0000000007EF1000-memory.dmp
memory/3972-23-0x00007FF647530000-0x00007FF6475C3000-memory.dmp
memory/3972-22-0x00007FF647530000-0x00007FF6475C3000-memory.dmp
memory/3972-21-0x00007FF647530000-0x00007FF6475C3000-memory.dmp