formbook | a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445

Analysis

max time kernel
145s
max time network
140s
platform
windows10_x64
resource
win10
submitted
19/08/2020, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
booking payments.exe
Size 1.0MB
Sample200819-g68sr65dv6
SHA256 a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445
MD5 cd4c0048444fce1f2199415a474fdba8
SHA1 88efdffd6819d63ac4cca898b13ab3c01553ed26
SHA512 5a1588d8983efb6655cd52bbf8eac211c28160433e0a004705f7679af4b2f6f28416bdefba7f33a0106f3bee15945084b70de3d308f0ad7f418a4f24b4c1fd04
MD5 SHA1 SHA512

Score

10^/10

rat persistence spyware trojan stealer formbook

Malware Config

Extracted

Family

formbook

http://www.fex-tracks.com/hx232/

Decoy

locavi33.com
footdirectch.com
carolinasofina.com
sarancasyab.com
ourdata.science
thewanderingnovice.com
hcijq.info
peasinabags.com
klobucharforpres.com
enthb.com
cleveparker.com
newsflixes.com
authorbrandonwong.com
bai44777.com
nesiacraft.com
sandhursthotel.com
motorcyclegas.insure
latestjobsnigeria.com
sylpt.com
usvsai.com
carmonaruizabogados.com
ultimate-baiak.com
xunrongda.com
rangeevents.com
luoyivision.com
purplepatriot.net
painlesscollective.com
ri7788.com
040369.com
wwwjinsha76.com
dunkirkappliances.com
companysolucoes.com
anatomixboys.com
brunoegeisa.com
gordanbarrett.com
rosagregg.com
coursezille.men
compareaway.com
sheloveshairbeautybar.com
tourskisrepare.com
krisnaloka.com
dd88a.com
gorakhpurmarket.com
virginrose.group
fortwojf.com
fivendimeshop.com
prestige-europe.com
tu215.com
pevidl.men
jacobusfamilyinvestors.com
qianhefanzhuang.com
zpjn978ifbqu41dmc.review
minnesotatech.com
chargedbyqi.com
templewebber.net
zctlz.info
bienesraicesgr.com
hackbob.com
totalplace.win
oklahomacollective.com
jixiangyanglaoyuan.com
sammamishpropertymanagement.com
xn--vuqp1e13s14y.com
kontrolunitesi.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 972 created 3608	972	WerFault.exe	70

Formbook Payload 10 IoCs

rat

resource	yara_rule
behavioral2/memory/1588-10-0x0000000000400000-0x00000000009322B7-memory.dmp	formbook
behavioral2/memory/1588-10-0x0000000000400000-0x00000000009322B7-memory.dmp	formbook
behavioral2/memory/1588-11-0x000000000041ED60-mapping.dmp	formbook
behavioral2/memory/2692-16-0x0000000000000000-mapping.dmp	formbook
behavioral2/memory/3800-26-0x000000000041ED60-mapping.dmp	formbook
behavioral2/memory/3800-25-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3800-25-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3708-239-0x0000000000000000-mapping.dmp	formbook
behavioral2/memory/4008-250-0x000000000041ED60-mapping.dmp	formbook
behavioral2/memory/1968-255-0x0000000000000000-mapping.dmp	formbook

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	colorcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\J4-TCDA8 = "C:\\Program Files (x86)\\Gtzf8t\\taskhostdldtdtbp.exe"	colorcpl.exe

Executes dropped EXE 12 IoCs

pid	Process
3828	ertoefqsph.pif
3608	RegSvcs.exe
1588	RegSvcs.exe
3712	ertoefqsph.pif
3800	RegSvcs.exe
3636	RegSvcs.exe
2132	ertoefqsph.pif
3908	ertoefqsph.pif
4008	RegSvcs.exe
2884	RegSvcs.exe
808	ertoefqsph.pif
1352	ertoefqsph.pif

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 3828 set thread context of 3608	3828	ertoefqsph.pif	70
PID 3828 set thread context of 1588	3828	ertoefqsph.pif	69
PID 1588 set thread context of 2980	1588	RegSvcs.exe	56
PID 2692 set thread context of 2980	2692	colorcpl.exe	56
PID 3712 set thread context of 3800	3712	ertoefqsph.pif	79
PID 3800 set thread context of 2980	3800	RegSvcs.exe	56
PID 3800 set thread context of 2980	3800	RegSvcs.exe	56
PID 3908 set thread context of 4008	3908	ertoefqsph.pif	92
PID 4008 set thread context of 2980	4008	RegSvcs.exe	56

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Gtzf8t\taskhostdldtdtbp.exe	colorcpl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
972	3608	WerFault.exe	70

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	colorcpl.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	ertoefqsph.pif
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	ertoefqsph.pif
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	ertoefqsph.pif
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	ertoefqsph.pif
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	ertoefqsph.pif

Suspicious behavior: EnumeratesProcesses 144 IoCs

pid	Process
3828	ertoefqsph.pif
3828	ertoefqsph.pif
1588	RegSvcs.exe
1588	RegSvcs.exe
1588	RegSvcs.exe
1588	RegSvcs.exe
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
2692	colorcpl.exe
2692	colorcpl.exe
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
3828	ertoefqsph.pif
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
3800	RegSvcs.exe
3800	RegSvcs.exe
3800	RegSvcs.exe
3800	RegSvcs.exe
3712	ertoefqsph.pif
3712	ertoefqsph.pif
2692	colorcpl.exe
2692	colorcpl.exe
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3800	RegSvcs.exe
3800	RegSvcs.exe
3712	ertoefqsph.pif
3712	ertoefqsph.pif
2692	colorcpl.exe
2692	colorcpl.exe
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3708	control.exe
3708	control.exe
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3712	ertoefqsph.pif
3712	ertoefqsph.pif
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2132	ertoefqsph.pif
2132	ertoefqsph.pif
2132	ertoefqsph.pif
2132	ertoefqsph.pif
2132	ertoefqsph.pif
2132	ertoefqsph.pif
2132	ertoefqsph.pif
2132	ertoefqsph.pif
2132	ertoefqsph.pif
2132	ertoefqsph.pif
2132	ertoefqsph.pif
2132	ertoefqsph.pif
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
4008	RegSvcs.exe
4008	RegSvcs.exe
4008	RegSvcs.exe
4008	RegSvcs.exe
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
2692	colorcpl.exe
2692	colorcpl.exe
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
3908	ertoefqsph.pif
1968	colorcpl.exe
1968	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
2692	colorcpl.exe
808	ertoefqsph.pif
808	ertoefqsph.pif
808	ertoefqsph.pif
808	ertoefqsph.pif
808	ertoefqsph.pif
808	ertoefqsph.pif
808	ertoefqsph.pif
808	ertoefqsph.pif
808	ertoefqsph.pif
808	ertoefqsph.pif
808	ertoefqsph.pif
808	ertoefqsph.pif
2692	colorcpl.exe
2692	colorcpl.exe

Suspicious behavior: MapViewOfSection 13 IoCs

pid	Process
1588	RegSvcs.exe
1588	RegSvcs.exe
1588	RegSvcs.exe
2692	colorcpl.exe
2692	colorcpl.exe
3800	RegSvcs.exe
3800	RegSvcs.exe
3800	RegSvcs.exe
3800	RegSvcs.exe
4008	RegSvcs.exe
4008	RegSvcs.exe
4008	RegSvcs.exe
2692	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	RegSvcs.exe
Token: SeDebugPrivilege	2692	colorcpl.exe
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeDebugPrivilege	3800	RegSvcs.exe
Token: SeDebugPrivilege	3708	control.exe
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeDebugPrivilege	4008	RegSvcs.exe
Token: SeDebugPrivilege	1968	colorcpl.exe
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3828	ertoefqsph.pif

Suspicious use of WriteProcessMemory 79 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 3828	3104	booking payments.exe	67
PID 3104 wrote to memory of 3828	3104	booking payments.exe	67
PID 3104 wrote to memory of 3828	3104	booking payments.exe	67
PID 3828 wrote to memory of 1588	3828	ertoefqsph.pif	69
PID 3828 wrote to memory of 1588	3828	ertoefqsph.pif	69
PID 3828 wrote to memory of 1588	3828	ertoefqsph.pif	69
PID 3828 wrote to memory of 3608	3828	ertoefqsph.pif	70
PID 3828 wrote to memory of 3608	3828	ertoefqsph.pif	70
PID 3828 wrote to memory of 3608	3828	ertoefqsph.pif	70
PID 3828 wrote to memory of 3608	3828	ertoefqsph.pif	70
PID 3828 wrote to memory of 3608	3828	ertoefqsph.pif	70
PID 3828 wrote to memory of 3608	3828	ertoefqsph.pif	70
PID 3828 wrote to memory of 1588	3828	ertoefqsph.pif	69
PID 3828 wrote to memory of 1588	3828	ertoefqsph.pif	69
PID 2980 wrote to memory of 2692	2980	Explorer.EXE	73
PID 2980 wrote to memory of 2692	2980	Explorer.EXE	73
PID 2980 wrote to memory of 2692	2980	Explorer.EXE	73
PID 2692 wrote to memory of 2688	2692	colorcpl.exe	74
PID 2692 wrote to memory of 2688	2692	colorcpl.exe	74
PID 2692 wrote to memory of 2688	2692	colorcpl.exe	74
PID 3828 wrote to memory of 2204	3828	ertoefqsph.pif	76
PID 3828 wrote to memory of 2204	3828	ertoefqsph.pif	76
PID 3828 wrote to memory of 2204	3828	ertoefqsph.pif	76
PID 2204 wrote to memory of 3712	2204	WScript.exe	77
PID 2204 wrote to memory of 3712	2204	WScript.exe	77
PID 2204 wrote to memory of 3712	2204	WScript.exe	77
PID 3712 wrote to memory of 3636	3712	ertoefqsph.pif	78
PID 3712 wrote to memory of 3636	3712	ertoefqsph.pif	78
PID 3712 wrote to memory of 3636	3712	ertoefqsph.pif	78
PID 3712 wrote to memory of 3800	3712	ertoefqsph.pif	79
PID 3712 wrote to memory of 3800	3712	ertoefqsph.pif	79
PID 3712 wrote to memory of 3800	3712	ertoefqsph.pif	79
PID 3712 wrote to memory of 3800	3712	ertoefqsph.pif	79
PID 3712 wrote to memory of 3800	3712	ertoefqsph.pif	79
PID 3712 wrote to memory of 3800	3712	ertoefqsph.pif	79
PID 2980 wrote to memory of 3708	2980	Explorer.EXE	80
PID 2980 wrote to memory of 3708	2980	Explorer.EXE	80
PID 2980 wrote to memory of 3708	2980	Explorer.EXE	80
PID 3712 wrote to memory of 1020	3712	ertoefqsph.pif	81
PID 3712 wrote to memory of 1020	3712	ertoefqsph.pif	81
PID 3712 wrote to memory of 1020	3712	ertoefqsph.pif	81
PID 1020 wrote to memory of 2132	1020	WScript.exe	83
PID 1020 wrote to memory of 2132	1020	WScript.exe	83
PID 1020 wrote to memory of 2132	1020	WScript.exe	83
PID 2132 wrote to memory of 412	2132	ertoefqsph.pif	89
PID 2132 wrote to memory of 412	2132	ertoefqsph.pif	89
PID 2132 wrote to memory of 412	2132	ertoefqsph.pif	89
PID 412 wrote to memory of 3908	412	WScript.exe	90
PID 412 wrote to memory of 3908	412	WScript.exe	90
PID 412 wrote to memory of 3908	412	WScript.exe	90
PID 3908 wrote to memory of 2884	3908	ertoefqsph.pif	91
PID 3908 wrote to memory of 2884	3908	ertoefqsph.pif	91
PID 3908 wrote to memory of 2884	3908	ertoefqsph.pif	91
PID 3908 wrote to memory of 4008	3908	ertoefqsph.pif	92
PID 3908 wrote to memory of 4008	3908	ertoefqsph.pif	92
PID 3908 wrote to memory of 4008	3908	ertoefqsph.pif	92
PID 3908 wrote to memory of 4008	3908	ertoefqsph.pif	92
PID 3908 wrote to memory of 4008	3908	ertoefqsph.pif	92
PID 3908 wrote to memory of 4008	3908	ertoefqsph.pif	92
PID 2980 wrote to memory of 1968	2980	Explorer.EXE	93
PID 2980 wrote to memory of 1968	2980	Explorer.EXE	93
PID 2980 wrote to memory of 1968	2980	Explorer.EXE	93
PID 3908 wrote to memory of 3100	3908	ertoefqsph.pif	94
PID 3908 wrote to memory of 3100	3908	ertoefqsph.pif	94
PID 3908 wrote to memory of 3100	3908	ertoefqsph.pif	94
PID 3100 wrote to memory of 808	3100	WScript.exe	95
PID 3100 wrote to memory of 808	3100	WScript.exe	95
PID 3100 wrote to memory of 808	3100	WScript.exe	95
PID 808 wrote to memory of 856	808	ertoefqsph.pif	96
PID 808 wrote to memory of 856	808	ertoefqsph.pif	96
PID 808 wrote to memory of 856	808	ertoefqsph.pif	96
PID 856 wrote to memory of 1352	856	WScript.exe	97
PID 856 wrote to memory of 1352	856	WScript.exe	97
PID 856 wrote to memory of 1352	856	WScript.exe	97
PID 2692 wrote to memory of 3496	2692	colorcpl.exe	98
PID 2692 wrote to memory of 3496	2692	colorcpl.exe	98
PID 2692 wrote to memory of 3496	2692	colorcpl.exe	98
PID 2692 wrote to memory of 936	2692	colorcpl.exe	100
PID 2692 wrote to memory of 936	2692	colorcpl.exe	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\booking payments.exe
  "C:\Users\Admin\AppData\Local\Temp\booking payments.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif
    "C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif" kojb.koi
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Executes dropped EXE
      PID:3608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 72
        5⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:972
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\15622377\run.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif
        
        "C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif" kojb.koi
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        6⤵
        Executes dropped EXE
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3800
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\15622377\run.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif
        
        "C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif" kojb.koi
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\15622377\run.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif
        
        "C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif" kojb.koi
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        10⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:4008
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\15622377\run.vbs"
        10⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif
        
        "C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif" kojb.koi
        11⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:808
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\15622377\run.vbs"
        12⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif
        
        "C:\Users\Admin\AppData\Roaming\15622377\ertoefqsph.pif" kojb.koi
        13⤵
        Executes dropped EXE
        
        PID:1352
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:3496
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:936
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\SysWOW64\control.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3708
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-15-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/1588-14-0x0000000072A90000-0x0000000072B23000-memory.dmp

Download

memory/1588-10-0x0000000000400000-0x00000000009322B7-memory.dmp

Download

memory/1968-257-0x0000000001270000-0x0000000001289000-memory.dmp

Download

memory/1968-256-0x0000000001270000-0x0000000001289000-memory.dmp

Download

memory/2692-18-0x0000000001270000-0x0000000001289000-memory.dmp

Download

memory/2692-17-0x0000000001270000-0x0000000001289000-memory.dmp

Download

memory/2692-24-0x0000000005F60000-0x0000000006036000-memory.dmp

Download

memory/2980-254-0x0000000006B50000-0x0000000006CCE000-memory.dmp

Download

memory/3708-240-0x0000000000A70000-0x0000000000A90000-memory.dmp

Download

memory/3708-241-0x0000000000A70000-0x0000000000A90000-memory.dmp

Download

memory/3800-25-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3828-4-0x0000000072A90000-0x0000000072B23000-memory.dmp

Download