Analysis
- max time kernel
151s - max time network
141s - platform
windows7_x64 - resource
win7 - submitted
18/08/2020, 11:44
General
- Target SCAN_PAYMENT ADVICE.scr
- Size 189KB
- Sample200818-llzzzcndd2
- SHA256 017bb0ec25e33f7dbefcac17b8bdfc5ca199579e0d7a14670270eef15ff8abce
Malware Config
Extracted
-
formbook
-
http://www.mage-cart.info/d9s8/
-
dengken.net
-
mifrio.com
-
testingin01beta.biz
-
upsidedownspeaking.net
-
808manx.com
-
tacticalthieves.com
-
hairbyedy.com
-
freddyrentcar.com
-
pacificbrandsuk.com
-
vienesta.com
-
juzi007.com
-
masterclasslaunchformula.com
-
sentrahidroponik.com
-
n-riched.com
-
codingcaptor.net
-
artisanal-wines.com
-
dreamycosmetics.com
-
cryptoxpace.com
-
honezanz.biz
-
rocknbpropertymanagement.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 6 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Program Files directory 1 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr"C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr"C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr"C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SCAN_PAYMENT ADVICE.scr"3⤵
- Deletes itself
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/368-9-0x0000000003360000-0x00000000034EF000-memory.dmp
memory/368-7-0x0000000000020000-0x0000000000027000-memory.dmp
memory/368-13-0x0000000003C80000-0x0000000003DB0000-memory.dmp
memory/368-10-0x0000000075DC0000-0x0000000075DCC000-memory.dmp
memory/368-11-0x00000000754C0000-0x00000000755DD000-memory.dmp
memory/1108-1-0x0000000001040000-0x0000000001041000-memory.dmp
memory/1108-2-0x00000000005A0000-0x00000000005D9000-memory.dmp
memory/1108-3-0x0000000004580000-0x00000000045B2000-memory.dmp
memory/1108-0-0x00000000748D0000-0x0000000074FBE000-memory.dmp
memory/1508-15-0x000000013FC80000-0x000000013FD13000-memory.dmp
memory/1624-4-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1896-12-0x000007FEF8010000-0x000007FEF828A000-memory.dmp