Analysis
- max time kernel
150s - max time network
151s - platform
windows10_x64 - resource
win10v200722 - submitted
01/10/2020, 21:44
General
- Target g5f91.exe
- Size 430KB
- Sample201001-jdy7wp2bas
- SHA256 0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d
Malware Config
Extracted
-
formbook
-
http://www.elevatedqueensnc.com/ajr/
-
cokefork.com
-
sunsabe.com
-
tactical-milsim.com
-
johnporcaro.com
-
quantqubit.com
-
ehrbar2012.com
-
dailymoringpages.com
-
masteronlineteams.com
-
signocomunicaciones.com
-
entrepreneur-de-demain.com
-
eve-echoes-data.com
-
readingbythewindow.com
-
quoteshark.net
-
mundoeconomic.com
-
bootlegmask.com
-
sporkedmissoula.com
-
claricitywealthplanning.net
-
lyotrade.net
-
brandtokitchens.com
-
blackstorymedia.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\g5f91.exe"C:\Users\Admin\AppData\Local\Temp\g5f91.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tfPErTSwFfzBj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF33.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\g5f91.exe"C:\Users\Admin\AppData\Local\Temp\g5f91.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\g5f91.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1644-13-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3452-20-0x0000000005320000-0x00000000053FF000-memory.dmp
memory/3452-18-0x00000000002E0000-0x00000000002E6000-memory.dmp
memory/3452-17-0x00000000002E0000-0x00000000002E6000-memory.dmp
memory/3908-5-0x00000000054E0000-0x00000000054E1000-memory.dmp
memory/3908-10-0x00000000061C0000-0x00000000061F3000-memory.dmp
memory/3908-9-0x0000000006130000-0x000000000617F000-memory.dmp
memory/3908-8-0x0000000005680000-0x0000000005684000-memory.dmp
memory/3908-7-0x00000000056A0000-0x00000000056A1000-memory.dmp
memory/3908-6-0x0000000005450000-0x0000000005451000-memory.dmp
memory/3908-0-0x0000000073DE0000-0x00000000744CE000-memory.dmp
memory/3908-4-0x00000000059E0000-0x00000000059E1000-memory.dmp
memory/3908-3-0x0000000005390000-0x0000000005391000-memory.dmp
memory/3908-1-0x0000000000B10000-0x0000000000B11000-memory.dmp