Analysis
- max time kernel
150s - max time network
12s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 19:54
General
- Target 18.05.20.exe
- Size 418KB
- Sample201109-srn7wstses
- SHA256 69a951205cf548cd5e5f086531d65a20918ffbfd5adabb79e6834cedcb056627
Malware Config
Extracted
-
formbook
-
http://www.regulars5.com/hx345/
-
firstcapstore.com
-
dsfixmonitore.win
-
kajeemee.com
-
etherdomeinnaam.com
-
tengodetodo.com
-
lifeofacaddie.com
-
prizone.net
-
sausachminhminh.com
-
investoreducationacademy.com
-
xaxyzmqyflgwls.com
-
mmbc-jtravel.com
-
kejiwaibao.com
-
mylittlerangebook.com
-
virtualinux.com
-
damayacupuntura.com
-
thepeoplesvoicematters.com
-
californiarehabloans.online
-
cannabisdoctorwestvirginia.com
-
kongholdings.com
-
sehu.ltd
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\18.05.20.exe"C:\Users\Admin\AppData\Local\Temp\18.05.20.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/872-10-0x0000000000720000-0x000000000073F000-memory.dmp
memory/872-12-0x0000000001E60000-0x0000000001F31000-memory.dmp
memory/1032-0-0x00000000746F0000-0x0000000074DDE000-memory.dmp
memory/1032-1-0x0000000000860000-0x0000000000861000-memory.dmp
memory/1032-3-0x0000000000270000-0x000000000027F000-memory.dmp
memory/1032-4-0x00000000002A0000-0x00000000002A2000-memory.dmp
memory/1032-5-0x0000000000420000-0x0000000000422000-memory.dmp
memory/1032-6-0x00000000007C0000-0x00000000007C3000-memory.dmp
memory/1684-7-0x0000000000400000-0x000000000042A000-memory.dmp