Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
05/11/2020, 09:17
General
- Target scnn7676766.exe
- Size 1.2MB
- Sample201105-vpemdb72es
- SHA256 2ca6ec7b8f70c8d16ad384a61e4c1cbb9ec02bd51e21648aa5f6af3fd40abd92
Malware Config
Extracted
-
formbook
-
http://www.militaryhomedecisions.com/m3px/
-
wiscoed.com
-
purecbnwholesale.com
-
propertymanagersfresno.com
-
value.rent
-
lucidmotors.asia
-
decoviewer.com
-
erotichypnotheapist.com
-
watchdoglogistics.com
-
secure05c-chase.com
-
thesleepycook.com
-
342stclairave.com
-
securebrandname.com
-
s53ss.com
-
nibblemirror.com
-
inflamgel.com
-
mansiobok3.info
-
iamprettysad.com
-
vilarealidadeaumentada.com
-
emergingalpha.report
-
kvtlawyers.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Formbook Payload 3 IoCs
- ModiLoader Second Stage 1 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\scnn7676766.exe"C:\Users\Admin\AppData\Local\Temp\scnn7676766.exe"2⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/916-0-0x0000000004BE0000-0x0000000004C41000-memory.dmp
memory/916-1-0x0000000010410000-0x000000001043E000-memory.dmp
memory/1056-9-0x00007FF6F77F0000-0x00007FF6F7883000-memory.dmp
memory/1056-10-0x00007FF6F77F0000-0x00007FF6F7883000-memory.dmp
memory/1056-11-0x00007FF6F77F0000-0x00007FF6F7883000-memory.dmp
memory/3596-2-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/3840-7-0x0000000005490000-0x00000000055BB000-memory.dmp
memory/3840-6-0x0000000000DC0000-0x0000000000DD2000-memory.dmp
memory/3840-5-0x0000000000DC0000-0x0000000000DD2000-memory.dmp