Analysis
- max time kernel
145s - max time network
135s - platform
windows10_x64 - resource
win10 - submitted
18/08/2020, 09:22
General
- Target NEW PRODUCT RFQ SPECIFICATION.exe
- Size 536KB
- Sample200818-x741bd1pyn
- SHA256 c62ef08103c30d5d2d18fbc2eff820985af40aa377828ef72c3ecad495103511
Malware Config
Extracted
-
formbook
-
http://www.funpexw.com/wba/
-
xiangxcongc.com
-
porttoken.com
-
migorganicsoap.com
-
askcoo.com
-
retiremerana.com
-
justinbible.com
-
landscapingcanberra.com
-
cannabiscapitaljournal.com
-
ycsfjx.com
-
xgwl555.com
-
ebc.group
-
studglasses.com
-
650358.com
-
quliancheba.com
-
disizmi.com
-
haomabaidu.com
-
bildungimdialog.com
-
fomoonline.com
-
transitionsales.com
-
isfxzm.men
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 4 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 41 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW PRODUCT RFQ SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\NEW PRODUCT RFQ SPECIFICATION.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2960-12-0x0000000000090000-0x000000000009A000-memory.dmp
memory/2960-13-0x0000000000090000-0x000000000009A000-memory.dmp
memory/3676-0-0x0000000073BA0000-0x000000007428E000-memory.dmp
memory/3676-5-0x0000000006350000-0x0000000006351000-memory.dmp
memory/3676-6-0x0000000005F30000-0x0000000005F31000-memory.dmp
memory/3676-7-0x0000000005C20000-0x0000000005C23000-memory.dmp
memory/3676-3-0x00000000053F0000-0x0000000005411000-memory.dmp
memory/3676-1-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/3924-8-0x0000000000400000-0x000000000042D000-memory.dmp