Analysis
- max time kernel
60s - max time network
122s - platform
windows10_x64 - resource
win10 - submitted
23/10/2020, 06:26
General
- Target Quotation.exe
- Size 581KB
- Sample201023-pp7vj25c8j
- SHA256 16a4855bceb4df02e0478cd72972a6e7f144f2278fedb239c2cb696cf6bf7199
Malware Config
Extracted
-
formbook
-
http://www.xqxsm.com/mc5/
-
bettermol.com
-
ludocrew.com
-
seidoknives.com
-
risunohonya.com
-
kaorukinoshita.com
-
filmblingalley.com
-
whenitclick.com
-
pathwaymediation.net
-
veracruzdigital.net
-
phoenixluxuries.com
-
3dyazicibaski.net
-
recorsaqu.com
-
mwilifirewire.online
-
dicobeuchert.com
-
vr036.com
-
ugenpt.com
-
mysecurityassessment.com
-
seolahmrekakorban04.com
-
outlierlearningcycle.com
-
dgwszjnmh.icu
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Program crash 2 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 15562⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1548-13-0x0000000000170000-0x000000000019E000-memory.dmp
memory/2632-17-0x00000000053C0000-0x00000000053C1000-memory.dmp
memory/2632-14-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
memory/2632-20-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/3404-8-0x0000000005E80000-0x0000000005E96000-memory.dmp
memory/3404-7-0x0000000007100000-0x0000000007101000-memory.dmp
memory/3404-6-0x00000000062B0000-0x00000000062B1000-memory.dmp
memory/3404-0-0x00000000735B0000-0x0000000073C9E000-memory.dmp
memory/3404-5-0x00000000067B0000-0x00000000067B1000-memory.dmp
memory/3404-3-0x00000000056F0000-0x0000000005722000-memory.dmp
memory/3404-1-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
memory/3656-15-0x0000000004A10000-0x0000000004A11000-memory.dmp