Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:34
General
-
Target
RFQ_19-027-MP-010203 _ 19-028-MP-010203 _ 19-029-MP-04.exe
-
Size
1.5MB
-
MD5
b2661762dc1e404771a05acaa650a8ad
-
SHA1
48a6b21d8df818d53da12fbf245dd0425719ca1d
-
SHA256
5fb176b2add40ae0aed7db10e9bf4755c86b63d66d4601370605b318d5bdb4b1
-
SHA512
eace4950d5a1f465411a4808265840acc9f95d095939b4c38b4854b7939593116e4c5e5de43c6bef982a7e41330f393effcea2249aa5aeea5c6125d3a022c01b
Malware Config
Extracted
formbook
http://www.insuranceforgrass.com/cdl/
camerawifichinhhang.info
fourruchos.com
linyomould.com
rockinghamseattle.com
yax95.com
gardenvaleps-athletics.com
fundaciojaumecasademont.cat
balpreetpankaj.com
flatlyforensics.com
nehyam.com
hundredpushup.com
iqellc.com
heemosco.com
wavegoodbyeto2020.com
idea2u.net
villamoonray.com
cloud9nutrition.com
propertybysyazliaty.com
chatbgsssjeni.com
babyessentialsonline.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_19-027-MP-010203 _ 19-028-MP-010203 _ 19-029-MP-04.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_19-027-MP-010203 _ 19-028-MP-010203 _ 19-029-MP-04.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ihfffYbnG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp378B.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RFQ_19-027-MP-010203 _ 19-028-MP-010203 _ 19-029-MP-04.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_19-027-MP-010203 _ 19-028-MP-010203 _ 19-029-MP-04.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ_19-027-MP-010203 _ 19-028-MP-010203 _ 19-029-MP-04.exe"3⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
ab85ffd95acbd536da8d2eeb187bd465
SHA1902640a732b491f075a5fde4aeb8b339dd3645ba
SHA2565d6760753ffe6dc974aff45b8068dee496ec452ad78b1c7b35ef237e27f15489
SHA51215fe3f2aa430853eb989ac1505ef6edf2dbbfe823b68fe8cf5bbe1a5e21308f863c985f94d6dbadfe79ff5957aba7704f9c13526d16188dae9947873a692bea0
-
-
-
-
Filesize
184KB
-
Filesize
3.1MB
-
Filesize
80KB
-
Filesize
1.2MB
-
Filesize
1.3MB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
184KB
-
Filesize
3.1MB
-
Filesize
588KB
-