Analysis
- max time kernel
150s - max time network
146s - platform
windows10_x64 - resource
win10 - submitted
15/10/2020, 13:07
General
- Target SKM120945.exe
- Size 436KB
- Sample201015-9rc47zhb3j
- SHA256 e85ece3cee51156974c3fb8f0e2c707dae2b51b0d2db9e5fb10531d2fdd76ca6
Malware Config
Extracted
-
formbook
-
http://www.ruartemoyano.com/xnc/
-
haitchworks.com
-
36rn.com
-
cc-js.com
-
godscult.com
-
partypooperlv.com
-
norcalsolarcleaning.com
-
vedatdmr.com
-
bbvau.com
-
abranna.com
-
pools.win
-
baltimoresoftware.com
-
sdafund.com
-
marketinglocal.digital
-
edyta-bober.com
-
uyorku.com
-
boudoirphotographerdallas.com
-
sunshineandcoffeeboutique.com
-
batttleroyaleuk.com
-
11382.xyz
-
euphoricjewelzz.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 49 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKM120945.exe"C:\Users\Admin\AppData\Local\Temp\SKM120945.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKM120945.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SKM120945.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1760-10-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1856-16-0x0000000004C40000-0x0000000004DAE000-memory.dmp
memory/1856-14-0x0000000000AD0000-0x0000000000B29000-memory.dmp
memory/1856-13-0x0000000000AD0000-0x0000000000B29000-memory.dmp
memory/3888-5-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
memory/3888-9-0x0000000009B00000-0x0000000009B4C000-memory.dmp
memory/3888-8-0x0000000007240000-0x00000000072A1000-memory.dmp
memory/3888-7-0x0000000004EF0000-0x0000000004EF4000-memory.dmp
memory/3888-6-0x0000000007170000-0x0000000007171000-memory.dmp
memory/3888-0-0x0000000073420000-0x0000000073B0E000-memory.dmp
memory/3888-4-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/3888-3-0x0000000005170000-0x0000000005171000-memory.dmp
memory/3888-1-0x0000000000410000-0x0000000000411000-memory.dmp