Analysis
- max time kernel
149s - max time network
137s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/12/2020, 07:20
General
- Target List items.exe
- Size 929KB
- Sample201209-1812apmm4a
- SHA256 42ea844a6aeb6c01de060355e8333242f71553498514ca1bf7d4af32bb90803e
Malware Config
Extracted
-
formbook
-
http://www.lalaandthelight.com/hts/
-
nymphomaniartist.com
-
thinkntyme.com
-
standardpharm.net
-
untangledesign.com
-
adrisable.com
-
theforgottencolony.com
-
renderpharma.com
-
jp231c.com
-
psilocybinenergy.com
-
oirtfqe.icu
-
viontelhotel.com
-
hotbloodedradio.com
-
motorstoretr.com
-
lapstan.com
-
takeexperts.com
-
elyzabeth.site
-
nicoloshoots.com
-
russpotts.com
-
forenvid.com
-
healinghappens.life
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\List items.exe"C:\Users\Admin\AppData\Local\Temp\List items.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DiUNRfivDpnY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp56BC.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\List items.exe"C:\Users\Admin\AppData\Local\Temp\List items.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\List items.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1404-17-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1628-14-0x0000000047060000-0x00000000470DC000-memory.dmp
memory/1628-7-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/1628-9-0x00000000058B0000-0x00000000058B1000-memory.dmp
memory/1628-10-0x0000000026BC0000-0x0000000046BA8000-memory.dmp
memory/1628-11-0x0000000046ED0000-0x0000000046F6A000-memory.dmp
memory/1628-12-0x0000000005CD0000-0x0000000005CD8000-memory.dmp
memory/1628-2-0x0000000073840000-0x0000000073F2E000-memory.dmp
memory/1628-8-0x0000000003160000-0x0000000003161000-memory.dmp
memory/1628-6-0x0000000005CE0000-0x0000000005CE1000-memory.dmp
memory/1628-5-0x0000000005620000-0x0000000005621000-memory.dmp
memory/1628-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/2304-21-0x0000000000C60000-0x0000000000C7E000-memory.dmp
memory/2304-22-0x0000000000C60000-0x0000000000C7E000-memory.dmp
memory/2304-24-0x0000000003F10000-0x0000000004006000-memory.dmp