Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10 - submitted
13/10/2020, 06:00
General
- Target Swift0011MGD.Scan.pdf..exe
- Size 650KB
- Sample201013-9h84l355rx
- SHA256 cc0807a29f920ca94099399975ae3d52b741d6f1387ea3fb26c44b1bc22cd95c
Score
10/10
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.darkatnightgame.com/fgn/
Decoy
-
kynguyendongho.com
-
seedtoskinnc.com
-
islaplants.com
-
bobbyfarris.com
-
xn--mgbuhw0d7a.com
-
sitestart.site
-
blendedprintz.com
-
honestwholesale.com
-
shuttandco.com
-
iangroupfunnels.com
-
ohanavendors.com
-
matreejewels.com
-
paras.ltd
-
1005cy.com
-
birdiecrane.com
-
dauntlessdigitalmanagement.com
-
wownewtech.net
-
instantpeindia.com
-
toshimaen-uosen.com
-
tlctrueloveconnection.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Swift0011MGD.Scan.pdf..exe"C:\Users\Admin\AppData\Local\Temp\Swift0011MGD.Scan.pdf..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Swift0011MGD.Scan.pdf..exe"C:\Users\Admin\AppData\Local\Temp\Swift0011MGD.Scan.pdf..exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Swift0011MGD.Scan.pdf..exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1408-0-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1640-3-0x0000000000D70000-0x0000000000D87000-memory.dmp
memory/1640-4-0x0000000000D70000-0x0000000000D87000-memory.dmp
memory/1640-6-0x0000000004850000-0x00000000049BB000-memory.dmp