Analysis
- max time kernel
15s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:29
General
- Target SecuriteInfo.com.MSIL.GenKryptik.EJVI.1956.exe
- Size 313KB
- Sample201109-2eb7jmtyks
- SHA256 21defefa3b5f49f5dda11d78c015138b8eb4ebf73f78975cf9bd91ace7beee7f
Malware Config
Extracted
-
formbook
-
http://www.mafov.com/tt0/
-
suannaidacha.com
-
jp1188.com
-
southernmostcbd.us
-
nuca.ltd
-
1he6.science
-
cpobill.com
-
bitcoinfeesinfo.com
-
ptdo2f.info
-
kauaispoutinghorn.com
-
salihkoroglu.com
-
thighvoltagerocks.com
-
greatvalleytopsoil.com
-
tallhairy.net
-
wordpressindex.com
-
race615.com
-
craftsmanadmiration.com
-
chinaicewine.net
-
iotacams.com
-
gadgetcucina.com
-
vannes-mobil-home.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- Formbook Payload 2 IoCs
- rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Windows security modification 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.EJVI.1956.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.EJVI.1956.exe"1⤵
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.EJVI.1956.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.EJVI.1956.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.EJVI.1956.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.EJVI.1956.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/744-0-0x0000000073A20000-0x000000007410E000-memory.dmp
memory/744-1-0x0000000000390000-0x0000000000391000-memory.dmp
memory/744-3-0x00000000050D0000-0x00000000050D1000-memory.dmp
memory/744-4-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/744-5-0x0000000004C20000-0x0000000004C21000-memory.dmp
memory/744-6-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/744-7-0x0000000004C50000-0x0000000004C53000-memory.dmp
memory/744-8-0x0000000004E20000-0x0000000004E6F000-memory.dmp
memory/744-9-0x0000000005650000-0x0000000005683000-memory.dmp
memory/1352-36-0x0000000000400000-0x000000000042A000-memory.dmp
memory/3064-14-0x0000000007B40000-0x0000000007B41000-memory.dmp
memory/3064-22-0x0000000009540000-0x0000000009573000-memory.dmp
memory/3064-15-0x0000000007BE0000-0x0000000007BE1000-memory.dmp
memory/3064-12-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/3064-16-0x0000000007E30000-0x0000000007E31000-memory.dmp
memory/3064-17-0x0000000007F60000-0x0000000007F61000-memory.dmp
memory/3064-18-0x0000000007F20000-0x0000000007F21000-memory.dmp
memory/3064-19-0x00000000082D0000-0x00000000082D1000-memory.dmp
memory/3064-20-0x0000000008570000-0x0000000008571000-memory.dmp
memory/3064-13-0x0000000007510000-0x0000000007511000-memory.dmp
memory/3064-29-0x0000000009520000-0x0000000009521000-memory.dmp
memory/3064-30-0x0000000009690000-0x0000000009691000-memory.dmp
memory/3064-31-0x00000000098B0000-0x00000000098B1000-memory.dmp
memory/3064-32-0x0000000009810000-0x0000000009811000-memory.dmp
memory/3064-34-0x00000000097F0000-0x00000000097F1000-memory.dmp
memory/3064-11-0x0000000073A20000-0x000000007410E000-memory.dmp