Analysis
- max time kernel
148s - max time network
138s - platform
windows10_x64 - resource
win10v20201028 - submitted
04/12/2020, 14:17
General
- Target Quotation Request No - 203.exe
- Size 943KB
- Sample201204-8xknpy2rgx
- SHA256 11ed6cc2222d5e0db7cc26544b9acf7370f2dab930e73a7268d388d73674b776
Malware Config
Extracted
-
formbook
-
http://www.danneroll.com/mnc/
-
yicaiboli.com
-
litercoconut.icu
-
virtuallyfriday.com
-
joshuahumphreyproperty.com
-
mercedes-dieselclaims.com
-
rock-leaf.com
-
sandglasshours.com
-
pooldeckpatiodriveway.com
-
forenvid.com
-
wasserfuhr-gmbh.com
-
rizosmil.com
-
alberletgyor.com
-
besafetexting.com
-
ladoctoracorazon.net
-
prettyassframes.com
-
meetyourwish.com
-
achefskiss.com
-
parulata.com
-
thang8-freefirevn2.xyz
-
statuniverse.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation Request No - 203.exe"C:\Users\Admin\AppData\Local\Temp\Quotation Request No - 203.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation Request No - 203.exe"C:\Users\Admin\AppData\Local\Temp\Quotation Request No - 203.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation Request No - 203.exe"C:\Users\Admin\AppData\Local\Temp\Quotation Request No - 203.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation Request No - 203.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2636-16-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3280-23-0x0000000006030000-0x0000000006116000-memory.dmp
memory/3280-21-0x0000000001370000-0x000000000166C000-memory.dmp
memory/3280-20-0x0000000001370000-0x000000000166C000-memory.dmp
memory/3988-7-0x0000000005440000-0x0000000005441000-memory.dmp
memory/3988-11-0x0000000026C40000-0x0000000046C28000-memory.dmp
memory/3988-12-0x0000000047000000-0x000000004704E000-memory.dmp
memory/3988-13-0x0000000005660000-0x0000000005668000-memory.dmp
memory/3988-15-0x0000000047140000-0x0000000047171000-memory.dmp
memory/3988-10-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3988-9-0x0000000005670000-0x0000000005671000-memory.dmp
memory/3988-8-0x00000000053F0000-0x00000000053F1000-memory.dmp
memory/3988-2-0x00000000738E0000-0x0000000073FCE000-memory.dmp
memory/3988-6-0x0000000005A00000-0x0000000005A01000-memory.dmp
memory/3988-5-0x0000000005300000-0x0000000005301000-memory.dmp
memory/3988-3-0x0000000000900000-0x0000000000901000-memory.dmp