Analysis
- max time kernel
149s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/11/2020, 07:35
General
- Target PO0119-1620 LQSB 0320 Siemens.exe
- Size 491KB
- Sample201119-zfst892ckn
- SHA256 2d7c03aa083b443c2cb1f0d296d9fc1afae5b9d1894bf4d1ba98b28568cd6ab3
Malware Config
Extracted
-
formbook
-
http://www.hz007.net/sppe/
-
eptelecom.com
-
nohangry.com
-
immersivecontenthub.com
-
shaesjewelryboutique.com
-
98700n.com
-
onlinewealthcourse.com
-
antietamfarm.com
-
thkryaat.com
-
51dhzs0r0vezt9.xyz
-
intotheweehours.com
-
mas-space.com
-
pawfrog.com
-
estrategiasdirectivas.com
-
dashelferlein.com
-
oreillyautotips.com
-
firstclassmarketingclub.com
-
elkhandcrafteddesigns.com
-
sanjanarikhi.com
-
murphyseafoodco.com
-
nmccafe.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO0119-1620 LQSB 0320 Siemens.exe"C:\Users\Admin\AppData\Local\Temp\PO0119-1620 LQSB 0320 Siemens.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO0119-1620 LQSB 0320 Siemens.exe"C:\Users\Admin\AppData\Local\Temp\PO0119-1620 LQSB 0320 Siemens.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO0119-1620 LQSB 0320 Siemens.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/452-16-0x0000000004A70000-0x0000000004B6C000-memory.dmp
memory/452-14-0x0000000001180000-0x0000000001187000-memory.dmp
memory/452-13-0x0000000001180000-0x0000000001187000-memory.dmp
memory/3152-17-0x0000000006770000-0x00000000068E9000-memory.dmp
memory/3316-10-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4796-5-0x00000000048F0000-0x000000000490F000-memory.dmp
memory/4796-9-0x00000000073A0000-0x00000000073A1000-memory.dmp
memory/4796-8-0x00000000071B0000-0x00000000071BA000-memory.dmp
memory/4796-7-0x00000000071D0000-0x00000000071D1000-memory.dmp
memory/4796-6-0x00000000075E0000-0x00000000075E1000-memory.dmp
memory/4796-0-0x00000000739D0000-0x00000000740BE000-memory.dmp
memory/4796-4-0x0000000004820000-0x0000000004837000-memory.dmp
memory/4796-3-0x0000000004930000-0x0000000004931000-memory.dmp
memory/4796-1-0x0000000000020000-0x0000000000021000-memory.dmp