Analysis
- max time kernel
62s - max time network
131s - platform
windows10_x64 - resource
win10 - submitted
26/10/2020, 14:54
General
- Target Doc-Quotation.exe
- Size 460KB
- Sample201026-wp6mg3jaqa
- SHA256 c9b3c7ce6446a64df017cf3301ab24a7993b1336befdec8bab77332fe783e4d4
Malware Config
Extracted
-
formbook
-
http://www.elchef.club/ee5/
-
amulfranchisedistribution.com
-
lovekids-toys.com
-
disenosinteligentesjgvg.com
-
theoriecursus.com
-
sthmtxujm.icu
-
yunzhangjiang.com
-
masterrodas.com
-
traditionzevents.com
-
solarenergysihai.com
-
alternovae.com
-
race3.info
-
falconfarmsresort.com
-
shackinnovations.net
-
agcsolutions.com
-
ngopirejeki.com
-
elevatora.net
-
jjmariephotography.com
-
prodigypod.com
-
smart-elasticreg.com
-
terryyaron.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc-Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Doc-Quotation.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Doc-Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Doc-Quotation.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 1883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1012-7-0x0000000005E60000-0x0000000005E76000-memory.dmp
memory/1012-3-0x00000000055A0000-0x00000000055D2000-memory.dmp
memory/1012-5-0x0000000006670000-0x0000000006671000-memory.dmp
memory/1012-6-0x0000000006210000-0x0000000006211000-memory.dmp
memory/1012-0-0x0000000073500000-0x0000000073BEE000-memory.dmp
memory/1012-1-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
memory/2156-11-0x00000000003B0000-0x00000000003DE000-memory.dmp
memory/2500-12-0x0000000004680000-0x0000000004681000-memory.dmp
memory/2500-14-0x0000000004BC0000-0x0000000004BC1000-memory.dmp