Analysis
- max time kernel
147s - max time network
141s - platform
windows10_x64 - resource
win10v20201028 - submitted
24/11/2020, 09:45
General
- Target Tracking No_SINI0068206497.exe
- Size 1.0MB
- Sample201124-fdtfrcedz2
- SHA256 ef84b1824587f465b36bafcbfbe6a14953e6de0a9420904662ba207984782c80
Malware Config
Extracted
-
formbook
-
http://www.libertraxengineering.com/rte/
-
thecreditcardcon.com
-
bcoltee.com
-
lyckaffe.com
-
lifebonusclub.com
-
hellolovelybookbox.net
-
robinsnesting.com
-
bunda7.com
-
showrov.online
-
mdfs.club
-
int-bp-departmt.com
-
grannymodern.com
-
bestdiany.com
-
inviotraffico.site
-
nymonroy.com
-
barberstradale.com
-
arvivsurgery.com
-
stylinglives.com
-
idealonerealty.com
-
riedelman.com
-
multicommerces.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.exe"C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.exe"C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1648-12-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3092-22-0x00007FF7B1900000-0x00007FF7B1993000-memory.dmp
memory/3092-24-0x00007FF7B1900000-0x00007FF7B1993000-memory.dmp
memory/3092-23-0x00007FF7B1900000-0x00007FF7B1993000-memory.dmp
memory/3336-7-0x0000000005C10000-0x0000000005C11000-memory.dmp
memory/3336-9-0x0000000006660000-0x00000000066C5000-memory.dmp
memory/3336-6-0x00000000058E0000-0x00000000058E1000-memory.dmp
memory/3336-1-0x0000000000FC0000-0x0000000000FC1000-memory.dmp
memory/3336-3-0x0000000005950000-0x0000000005951000-memory.dmp
memory/3336-4-0x0000000005EF0000-0x0000000005EF1000-memory.dmp
memory/3336-5-0x00000000059F0000-0x00000000059F1000-memory.dmp
memory/3336-11-0x00000000067F0000-0x0000000006820000-memory.dmp
memory/3336-0-0x0000000073970000-0x000000007405E000-memory.dmp
memory/3336-10-0x00000000067D0000-0x00000000067D6000-memory.dmp
memory/3336-8-0x0000000005920000-0x0000000005934000-memory.dmp
memory/3756-19-0x00000000058F0000-0x0000000005993000-memory.dmp
memory/3756-17-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/3756-16-0x0000000000D10000-0x0000000000D22000-memory.dmp