Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7v20201028 - submitted
07/11/2020, 10:27
General
- Target Additional Agreement 2020-KYC.exe
- Size 580KB
- Sample201107-c8aedqbcha
- SHA256 8c0577ec4537880647e232dc1c3b0c722bb1efc0f8f4ea99729ed3607a1dace2
Malware Config
Extracted
-
formbook
-
http://www.csgo-c4ses.com/bw82/
-
orchid-iris.com
-
owner.codes
-
crispcleanbodyrituals.com
-
nocreditcarswestpalm.com
-
sweetsasu.com
-
downlooader.com
-
candleish.com
-
43414newportdr.com
-
78kanshu.net
-
tncnn.com
-
bcheaptvwd.com
-
trephone.art
-
aloharecords.com
-
latinaexpres.com
-
comminterbusiness.com
-
evokingcalm.com
-
mckarthylabscoe.com
-
make-trends.com
-
modernhomeskitchen.com
-
mousybusiness.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Additional Agreement 2020-KYC.exe"C:\Users\Admin\AppData\Local\Temp\Additional Agreement 2020-KYC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Additional Agreement 2020-KYC.exe"Additional Agreement 2020-KYC.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Additional Agreement 2020-KYC.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/836-0-0x00000000746D0000-0x0000000074DBE000-memory.dmp
memory/836-1-0x0000000000220000-0x0000000000221000-memory.dmp
memory/836-3-0x00000000046B0000-0x00000000046DF000-memory.dmp
memory/912-8-0x0000000000580000-0x0000000000588000-memory.dmp
memory/912-10-0x00000000032A0000-0x00000000033E8000-memory.dmp
memory/924-5-0x0000000000400000-0x0000000000428000-memory.dmp