Analysis
- max time kernel
27s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:54
General
- Target 18.05.20.exe
- Size 418KB
- Sample201109-srn7wstses
- SHA256 69a951205cf548cd5e5f086531d65a20918ffbfd5adabb79e6834cedcb056627
Malware Config
Extracted
-
formbook
-
http://www.regulars5.com/hx345/
-
firstcapstore.com
-
dsfixmonitore.win
-
kajeemee.com
-
etherdomeinnaam.com
-
tengodetodo.com
-
lifeofacaddie.com
-
prizone.net
-
sausachminhminh.com
-
investoreducationacademy.com
-
xaxyzmqyflgwls.com
-
mmbc-jtravel.com
-
kejiwaibao.com
-
mylittlerangebook.com
-
virtualinux.com
-
damayacupuntura.com
-
thepeoplesvoicematters.com
-
californiarehabloans.online
-
cannabisdoctorwestvirginia.com
-
kongholdings.com
-
sehu.ltd
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\18.05.20.exe"C:\Users\Admin\AppData\Local\Temp\18.05.20.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 1883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/560-12-0x0000000000600000-0x000000000062A000-memory.dmp
memory/796-4-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/796-5-0x0000000002D50000-0x0000000002D52000-memory.dmp
memory/796-6-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/796-7-0x00000000054B0000-0x00000000054B2000-memory.dmp
memory/796-8-0x0000000005760000-0x0000000005761000-memory.dmp
memory/796-9-0x00000000054F0000-0x00000000054F3000-memory.dmp
memory/796-0-0x00000000739A0000-0x000000007408E000-memory.dmp
memory/796-3-0x0000000002D30000-0x0000000002D3F000-memory.dmp
memory/796-1-0x00000000009F0000-0x00000000009F1000-memory.dmp
memory/3212-13-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
memory/3212-15-0x0000000005380000-0x0000000005381000-memory.dmp