Analysis
- max time kernel
118s - max time network
117s - platform
windows10_x64 - resource
win10 - submitted
12/10/2020, 07:36
General
- Target Quotation.exe
- Size 500KB
- Sample201012-vw4xp14men
- SHA256 dbdd8dc5bf8c5f81b9cbead4224bade6cd697f6f00cbab59bf084f6e39578a8d
Malware Config
Extracted
-
formbook
-
http://www.networkafterparty.com/jub/
-
doitcuz.com
-
kredit-goals.com
-
hyz88888.net
-
yinleba.com
-
flowshopaz.com
-
salonaconsultant.com
-
nsaidnwiasa.com
-
snarezo.com
-
sydneylottereytoday.club
-
jobcollate.com
-
victormsalazar.com
-
kohllrx.com
-
prepper-property.com
-
wiseowltreeco.com
-
xn--rpr9a881q.com
-
6degreesweat.com
-
qddelongship.com
-
kvpalwal.com
-
relaxagva.com
-
neodew.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 1883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1840-13-0x00000000001C0000-0x00000000001EE000-memory.dmp
memory/2148-14-0x0000000004E70000-0x0000000004E71000-memory.dmp
memory/2148-17-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/3828-8-0x0000000006200000-0x0000000006216000-memory.dmp
memory/3828-6-0x0000000005540000-0x0000000005541000-memory.dmp
memory/3828-5-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/3828-4-0x0000000005A40000-0x0000000005A41000-memory.dmp
memory/3828-0-0x0000000073620000-0x0000000073D0E000-memory.dmp
memory/3828-3-0x0000000002E30000-0x0000000002E67000-memory.dmp
memory/3828-1-0x0000000000AC0000-0x0000000000AC1000-memory.dmp