Analysis
- max time kernel
41s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:56
General
- Target 05- 06-20INQ.exe
- Size 438KB
- Sample201109-ebl7clvmqa
- SHA256 ca1a1e6067f0780b53d1863908555e55ad98c42d8af34d00be76f656d2d9a2fe
Malware Config
Extracted
-
formbook
-
http://www.sudelt.com/rk3/
-
cedarridgerussellterriers.com
-
zamperl-couture.com
-
8minutesprofitlink.com
-
yuyinyue.net
-
castleminerforum.com
-
habbodm.biz
-
tektlc.life
-
strive2thriveglobal.com
-
richen8.com
-
ettlingen.digital
-
clairegoals.com
-
clearptsd.biz
-
wxqingtai.com
-
matttoken.com
-
macopride.com
-
hudong.ltd
-
wirelessantalya.com
-
connectlibrary.com
-
ourtime.site
-
vitalitymax.life
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05- 06-20INQ.exe"C:\Users\Admin\AppData\Local\Temp\05- 06-20INQ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3164-18-0x00000000055B0000-0x00000000055B1000-memory.dmp
memory/3164-15-0x0000000005080000-0x0000000005081000-memory.dmp
memory/4164-14-0x00000000005C0000-0x00000000005ED000-memory.dmp
memory/4628-5-0x0000000000FC0000-0x0000000000FC2000-memory.dmp
memory/4628-9-0x0000000002CD0000-0x0000000002CD2000-memory.dmp
memory/4628-10-0x00000000064B0000-0x00000000064B1000-memory.dmp
memory/4628-8-0x0000000005410000-0x0000000005411000-memory.dmp
memory/4628-7-0x0000000002CC0000-0x0000000002CC2000-memory.dmp
memory/4628-6-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/4628-0-0x0000000073D60000-0x000000007444E000-memory.dmp
memory/4628-4-0x0000000005730000-0x0000000005731000-memory.dmp
memory/4628-3-0x0000000000F90000-0x0000000000F9E000-memory.dmp
memory/4628-1-0x0000000000890000-0x0000000000891000-memory.dmp