Analysis
- max time kernel
147s - max time network
134s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/01/2021, 07:55
General
- Target Details for bookings.exe
- Size 999KB
- Sample210119-e6ax4ynl42
- SHA256 39872cee88d7cf4d0f0cc42d09348b6fea960a62861fab210bf257c4e6bc3a36
Malware Config
Extracted
-
formbook
-
http://www.deuxus.com/t052/
-
ladybug-learning.com
-
unforgottenstory.com
-
oldmopaiv.xyz
-
natashaexim.com
-
hannahmcelgunn.com
-
retargetingmachines.info
-
njoconline.com
-
unicornlankadelivery.com
-
giftkerala.com
-
englishfordoctors.online
-
schatzilandrvresort.com
-
brujoisaac.com
-
basiccampinggear.com
-
escapees.today
-
dgyxsy888.com
-
stevebana.xyz
-
mimozakebap.com
-
ezdoff.com
-
pluumyspalace.com
-
shaoshanshan.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 41 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Details for bookings.exe"C:\Users\Admin\AppData\Local\Temp\Details for bookings.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Details for bookings.exe"C:\Users\Admin\AppData\Local\Temp\Details for bookings.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Details for bookings.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/528-13-0x0000000000400000-0x000000000042E000-memory.dmp
memory/528-17-0x0000000001C70000-0x0000000001C84000-memory.dmp
memory/528-16-0x0000000001950000-0x0000000001C70000-memory.dmp
memory/1012-24-0x0000000004DB0000-0x0000000004E43000-memory.dmp
memory/1012-23-0x0000000004A90000-0x0000000004DB0000-memory.dmp
memory/1012-21-0x00000000009A0000-0x00000000009CE000-memory.dmp
memory/1012-20-0x0000000000CD0000-0x0000000000CE3000-memory.dmp
memory/3012-18-0x00000000058F0000-0x0000000005A25000-memory.dmp
memory/3012-25-0x00000000057D0000-0x00000000058DB000-memory.dmp
memory/4776-12-0x00000000060C0000-0x0000000006126000-memory.dmp
memory/4776-3-0x0000000000B00000-0x0000000000B01000-memory.dmp
memory/4776-5-0x00000000054B0000-0x00000000054B1000-memory.dmp
memory/4776-2-0x0000000073150000-0x000000007383E000-memory.dmp
memory/4776-6-0x0000000005A50000-0x0000000005A51000-memory.dmp
memory/4776-7-0x0000000005550000-0x0000000005551000-memory.dmp
memory/4776-8-0x0000000005610000-0x0000000005611000-memory.dmp
memory/4776-11-0x0000000005730000-0x0000000005731000-memory.dmp
memory/4776-10-0x0000000005650000-0x0000000005673000-memory.dmp
memory/4776-9-0x00000000056B0000-0x00000000056B1000-memory.dmp