Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    10/11/2020, 08:51

General

  • Target
    payment delay.exe
  • Size 756KB
  • Sample201110-spff7ecjf2
  • SHA256 598bcdbe4c3e21a17a48d44dc03640f90643d1a03549ec429c7f96fd48e6a7ea
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.bestancasterrealestateagent.com/shwq/

Decoy
  • yrataglance.com

  • lowcarbindulgence.com

  • xiangoshi.com

  • dev-dale.com

  • denichon.com

  • sewinplace.com

  • blandiskodk.com

  • iphonejailbreakplus.com

  • ramkihome.com

  • weargoodsport.com

  • fnafrica.com

  • yusuferdogan.com

  • chuqiong.com

  • cxmasmobitvmall.com

  • autosystems-mali.com

  • lacevortex.com

  • finessebygrace.com

  • gmz.one

  • catiemarvin.com

  • icesmooth.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 5 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 18560 IoCs
  • Suspicious behavior: MapViewOfSection 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Users\Admin\AppData\Local\Temp\payment delay.exe
      "C:\Users\Admin\AppData\Local\Temp\payment delay.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:912
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:3556
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2568
        • C:\Users\Admin\AppData\Local\Temp\payment delay.exe
          "C:\Users\Admin\AppData\Local\Temp\payment delay.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:572
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:2840
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
                PID:2272
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                PID:3872
          • C:\Windows\SysWOW64\explorer.exe
            "C:\Windows\SysWOW64\explorer.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:200
            • C:\Windows\SysWOW64\cmd.exe
              /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:3920
            • C:\Windows\SysWOW64\autofmt.exe
              "C:\Windows\SysWOW64\autofmt.exe"
              2⤵
                PID:1428
              • C:\Windows\SysWOW64\autofmt.exe
                "C:\Windows\SysWOW64\autofmt.exe"
                2⤵
                  PID:1032
                • C:\Windows\SysWOW64\autofmt.exe
                  "C:\Windows\SysWOW64\autofmt.exe"
                  2⤵
                    PID:524
                  • C:\Windows\SysWOW64\autofmt.exe
                    "C:\Windows\SysWOW64\autofmt.exe"
                    2⤵
                      PID:984
                    • C:\Windows\SysWOW64\autofmt.exe
                      "C:\Windows\SysWOW64\autofmt.exe"
                      2⤵
                        PID:3628
                      • C:\Windows\SysWOW64\autofmt.exe
                        "C:\Windows\SysWOW64\autofmt.exe"
                        2⤵
                          PID:1504
                        • C:\Windows\SysWOW64\autofmt.exe
                          "C:\Windows\SysWOW64\autofmt.exe"
                          2⤵
                            PID:2148
                          • C:\Windows\SysWOW64\raserver.exe
                            "C:\Windows\SysWOW64\raserver.exe"
                            2⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2392

                        Network

                              MITRE ATT&CK Matrix

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              memory/200-27-0x0000000005870000-0x00000000059A8000-memory.dmp

                              memory/200-22-0x0000000001090000-0x00000000014CF000-memory.dmp

                              memory/200-21-0x0000000001090000-0x00000000014CF000-memory.dmp

                              memory/572-10-0x0000000073800000-0x0000000073EEE000-memory.dmp

                              memory/912-4-0x00000000053D0000-0x0000000005405000-memory.dmp

                              memory/912-0-0x0000000073800000-0x0000000073EEE000-memory.dmp

                              memory/912-6-0x00000000064E0000-0x000000000650E000-memory.dmp

                              memory/912-3-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                              memory/912-1-0x0000000000560000-0x0000000000561000-memory.dmp

                              memory/2392-25-0x00000000013D0000-0x00000000013EF000-memory.dmp

                              memory/2392-26-0x00000000013D0000-0x00000000013EF000-memory.dmp

                              memory/2568-7-0x0000000000400000-0x000000000042E000-memory.dmp