Analysis
- max time kernel
148s - max time network
147s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/11/2020, 07:12
General
- Target MV.KMTC JEBEL ALI_pdf.exe
- Size 432KB
- Sample201119-vr74gg2g4a
- SHA256 e919d1c10bd867f71a99a7aaa5c52221c4e79341c2389880596a8d1ef9ed5a13
Malware Config
Extracted
-
formbook
-
http://www.mereziboutique.com/y9z/
-
treasuredplants.com
-
smartcontracttransportation.com
-
apollo-innovation.com
-
medicalitpros.com
-
bluegrassexoticpets.com
-
chosencapitals.com
-
carwashcustom.com
-
clevelandcorp.net
-
3dparkstudio.com
-
robinfly.net
-
youtube4you.com
-
codigopost.com
-
medicalassistantcorp.com
-
citestpridom20200818042828.com
-
zonetraining.asia
-
popper-minefield.com
-
brewsom3.coffee
-
wieldideasagency.club
-
aeco.online
-
1286711.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MV.KMTC JEBEL ALI_pdf.exe"C:\Users\Admin\AppData\Local\Temp\MV.KMTC JEBEL ALI_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MV.KMTC JEBEL ALI_pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MV.KMTC JEBEL ALI_pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1736-16-0x00000000056B0000-0x000000000575B000-memory.dmp
memory/1736-14-0x0000000000940000-0x0000000000C3C000-memory.dmp
memory/1736-13-0x0000000000940000-0x0000000000C3C000-memory.dmp
memory/3868-10-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4696-5-0x0000000004B90000-0x0000000004B91000-memory.dmp
memory/4696-9-0x0000000008420000-0x0000000008421000-memory.dmp
memory/4696-8-0x0000000008320000-0x0000000008378000-memory.dmp
memory/4696-7-0x0000000008090000-0x00000000080A4000-memory.dmp
memory/4696-6-0x00000000085C0000-0x00000000085C1000-memory.dmp
memory/4696-0-0x0000000073CE0000-0x00000000743CE000-memory.dmp
memory/4696-4-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
memory/4696-3-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
memory/4696-1-0x0000000000240000-0x0000000000241000-memory.dmp