Overview

overview

10

Static

static

4b645d8201...cd.exe

windows7_x64

10

4b645d8201...cd.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    08/10/2020, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4b645d82013cf24c3867952cd987bdcd.exe
  • Size 477KB
  • Sample201008-vr2c4kn2y6
  • SHA256 8fc52ab78b091873ee351be8fed2c5026d9fdae75ddfe910ea2b179843ca0c3f
  • MD5 SHA1 SHA512
Score
10/10
ratpersistencetrojanspywarestealerformbook

Malware Config

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 3 IoCs
    rat
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Users\Admin\AppData\Local\Temp\4b645d82013cf24c3867952cd987bdcd.exe
      "C:\Users\Admin\AppData\Local\Temp\4b645d82013cf24c3867952cd987bdcd.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:496
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v nsgiyh /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\jbsge.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4020
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v nsgiyh /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\jbsge.exe"
          4⤵
          • Adds Run key to start application
          PID:3140
      • C:\Users\Admin\jbsge.exe
        "C:\Users\Admin\jbsge.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3044
        • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
          "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2184
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\SysWOW64\netsh.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3580
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
        3⤵
          PID:1580

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/496-6-0x0000000005790000-0x0000000005791000-memory.dmp
          Download

          memory/496-5-0x00000000056A0000-0x00000000056A1000-memory.dmp
          Download

          memory/496-4-0x0000000005B10000-0x0000000005B11000-memory.dmp
          Download

          memory/496-0-0x0000000073700000-0x0000000073DEE000-memory.dmp
          Download

          memory/496-3-0x00000000055D0000-0x0000000005607000-memory.dmp
          Download

          memory/496-1-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
          Download

          memory/2184-24-0x0000000000400000-0x000000000042E000-memory.dmp
          Download

          memory/3044-22-0x00000000065F0000-0x0000000006606000-memory.dmp
          Download

          memory/3044-13-0x0000000073700000-0x0000000073DEE000-memory.dmp
          Download

          memory/3580-28-0x00000000008A0000-0x00000000008BE000-memory.dmp
          Download

          memory/3580-29-0x00000000008A0000-0x00000000008BE000-memory.dmp
          Download

          memory/3580-32-0x0000000004310000-0x000000000442C000-memory.dmp
          Download