Analysis
- max time kernel
148s - max time network
145s - platform
windows10_x64 - resource
win10v200722 - submitted
09/10/2020, 06:10
General
- Target Swift01141.Scan.pdf..exe
- Size 830KB
- Sample201009-25lfymr11n
- SHA256 80a9f4ef9f226558954221ab49e2df9557a030d87946368bfb51e7440bd58d8b
Malware Config
Extracted
-
formbook
-
http://www.darkatnightgame.com/fgn/
-
kynguyendongho.com
-
seedtoskinnc.com
-
islaplants.com
-
bobbyfarris.com
-
xn--mgbuhw0d7a.com
-
sitestart.site
-
blendedprintz.com
-
honestwholesale.com
-
shuttandco.com
-
iangroupfunnels.com
-
ohanavendors.com
-
matreejewels.com
-
paras.ltd
-
1005cy.com
-
birdiecrane.com
-
dauntlessdigitalmanagement.com
-
wownewtech.net
-
instantpeindia.com
-
toshimaen-uosen.com
-
tlctrueloveconnection.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Swift01141.Scan.pdf..exe"C:\Users\Admin\AppData\Local\Temp\Swift01141.Scan.pdf..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Swift01141.Scan.pdf..exe"C:\Users\Admin\AppData\Local\Temp\Swift01141.Scan.pdf..exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Swift01141.Scan.pdf..exe"C:\Users\Admin\AppData\Local\Temp\Swift01141.Scan.pdf..exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Swift01141.Scan.pdf..exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3220-11-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3572-17-0x0000000004AD0000-0x0000000004BF2000-memory.dmp
memory/3572-15-0x0000000000C40000-0x0000000000C4C000-memory.dmp
memory/3572-14-0x0000000000C40000-0x0000000000C4C000-memory.dmp
memory/3648-5-0x0000000007110000-0x0000000007111000-memory.dmp
memory/3648-9-0x000000000BCF0000-0x000000000BD65000-memory.dmp
memory/3648-10-0x000000000BD70000-0x000000000BDCB000-memory.dmp
memory/3648-8-0x0000000009A70000-0x000000000BA6F000-memory.dmp
memory/3648-7-0x00000000072C0000-0x00000000072C1000-memory.dmp
memory/3648-6-0x0000000004B20000-0x0000000004B21000-memory.dmp
memory/3648-0-0x0000000073FA0000-0x000000007468E000-memory.dmp
memory/3648-4-0x0000000007570000-0x0000000007571000-memory.dmp
memory/3648-3-0x0000000006FD0000-0x0000000006FD1000-memory.dmp
memory/3648-1-0x00000000000B0000-0x00000000000B1000-memory.dmp