Analysis
- max time kernel
151s - max time network
138s - platform
windows7_x64 - resource
win7 - submitted
13/10/2020, 06:48
General
- Target PO 20201013_file_xls.exe
- Size 707KB
- Sample201013-66fgflnc8s
- SHA256 af61853ca27001c0721463fce68bb033a9084e9fcd0c6ced3acd7fc3ea0e957a
Malware Config
Extracted
-
formbook
-
http://www.mybriefbox.com/sdk/
-
mosquitobandidos.com
-
yisecurityfirst.com
-
faip777.icu
-
nc-tv.com
-
tifeeds.com
-
techlez.com
-
newalbanyironworks.com
-
shadent.store
-
therealworldtravel.com
-
cryptocoinminingpro.com
-
lobard.com
-
iamforexbots.com
-
cottnon.com
-
dandaanyar.com
-
browtopia.space
-
mo-diamond-mining.com
-
inteholistichealth.clinic
-
bhargavmistry.com
-
justgraceboutique.com
-
africanwomenabroad.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 20201013_file_xls.exe"C:\Users\Admin\AppData\Local\Temp\PO 20201013_file_xls.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 20201013_file_xls.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO 20201013_file_xls.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1124-0-0x00000000740F0000-0x00000000747DE000-memory.dmp
memory/1124-1-0x0000000000E10000-0x0000000000E11000-memory.dmp
memory/1124-3-0x00000000003A0000-0x00000000003A4000-memory.dmp
memory/1124-4-0x00000000056D0000-0x000000000575E000-memory.dmp
memory/1124-5-0x0000000000630000-0x00000000006AD000-memory.dmp
memory/1908-7-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1948-10-0x00000000007E0000-0x00000000007FF000-memory.dmp
memory/1948-12-0x0000000002FB0000-0x00000000030F5000-memory.dmp