Analysis
- max time kernel
148s - max time network
148s - platform
windows10_x64 - resource
win10v200722 - submitted
13/10/2020, 06:48
General
- Target PO 20201013_file_xls.exe
- Size 707KB
- Sample201013-66fgflnc8s
- SHA256 af61853ca27001c0721463fce68bb033a9084e9fcd0c6ced3acd7fc3ea0e957a
Malware Config
Extracted
-
formbook
-
http://www.mybriefbox.com/sdk/
-
mosquitobandidos.com
-
yisecurityfirst.com
-
faip777.icu
-
nc-tv.com
-
tifeeds.com
-
techlez.com
-
newalbanyironworks.com
-
shadent.store
-
therealworldtravel.com
-
cryptocoinminingpro.com
-
lobard.com
-
iamforexbots.com
-
cottnon.com
-
dandaanyar.com
-
browtopia.space
-
mo-diamond-mining.com
-
inteholistichealth.clinic
-
bhargavmistry.com
-
justgraceboutique.com
-
africanwomenabroad.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 47 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 20201013_file_xls.exe"C:\Users\Admin\AppData\Local\Temp\PO 20201013_file_xls.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 20201013_file_xls.exe"{path}"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PO 20201013_file_xls.exe"{path}"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PO 20201013_file_xls.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO 20201013_file_xls.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/348-10-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1880-17-0x0000000003E40000-0x0000000003EFB000-memory.dmp
memory/1880-15-0x0000000000890000-0x00000000008E9000-memory.dmp
memory/1880-14-0x0000000000890000-0x00000000008E9000-memory.dmp
memory/3956-5-0x0000000005160000-0x0000000005161000-memory.dmp
memory/3956-9-0x0000000009F20000-0x0000000009F9D000-memory.dmp
memory/3956-8-0x0000000007780000-0x000000000780E000-memory.dmp
memory/3956-7-0x00000000055D0000-0x00000000055D4000-memory.dmp
memory/3956-6-0x0000000007520000-0x0000000007521000-memory.dmp
memory/3956-0-0x0000000073490000-0x0000000073B7E000-memory.dmp
memory/3956-4-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/3956-3-0x0000000005620000-0x0000000005621000-memory.dmp
memory/3956-1-0x0000000000860000-0x0000000000861000-memory.dmp