Analysis
- max time kernel
150s - max time network
141s - platform
windows10_x64 - resource
win10v200722 - submitted
07/10/2020, 08:59
General
- Target SecuriteInfo.com.BehavesLike.Win32.Fareit.gc.4989.exe
- Size 472KB
- Sample201007-a6mw97j1ms
- SHA256 ff12520da32ca8d2478c1bdfbdbe7e057d3d6f079d81ceb2fc86c539889e1280
Malware Config
Extracted
-
formbook
-
http://www.funpexw.com/dmr/
-
thietkewebngay.com
-
fdgre.com
-
silverbuzzer.com
-
d55105.com
-
ccc693.com
-
diptya.net
-
oleasalon.com
-
vjvtjkic.biz
-
edmsociety.com
-
siyahmaske.win
-
lmnp-occasion.com
-
platocosmos.com
-
fakua.top
-
albertabarricade.com
-
kakaninrecipes.com
-
bestsmokeapp.com
-
hotelsitaly.online
-
brewtopiaapp.com
-
1q1twoother.men
-
wwwmaharashtratimes.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Fareit.gc.4989.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Fareit.gc.4989.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v nsym /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\dgjh.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v nsym /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\dgjh.exe"4⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\dgjh.exe"C:\Users\Admin\dgjh.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/208-24-0x0000000000400000-0x000000000042D000-memory.dmp
memory/932-29-0x0000000000EE0000-0x00000000011DC000-memory.dmp
memory/932-33-0x0000000006240000-0x0000000006307000-memory.dmp
memory/932-30-0x0000000000EE0000-0x00000000011DC000-memory.dmp
memory/1880-13-0x0000000073490000-0x0000000073B7E000-memory.dmp
memory/1880-22-0x0000000005960000-0x0000000005976000-memory.dmp
memory/3956-5-0x0000000005860000-0x0000000005861000-memory.dmp
memory/3956-0-0x0000000073490000-0x0000000073B7E000-memory.dmp
memory/3956-3-0x00000000031E0000-0x0000000003217000-memory.dmp
memory/3956-1-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/3956-4-0x0000000005D10000-0x0000000005D11000-memory.dmp
memory/3956-6-0x0000000005950000-0x0000000005951000-memory.dmp