Analysis
- max time kernel
149s - max time network
128s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/02/2021, 13:17
General
- Target RFQ - ASTROFREIGHT FEB21-0621pdf.exe
- Size 474KB
- Sample210209-kxt53vatjj
- SHA256 044d4416e986fb7fd91bc96639efe48e87cfd33857e199c48cf6e7f4d07a3db2
Malware Config
Extracted
-
formbook
-
http://www.thedilleyo.com/kb8/
-
goodsforbuilders.com
-
dafuhe.com
-
parapharmacity.com
-
montclairymcamotionvibe.com
-
jamesmccloudart.com
-
reignfallentertainment.com
-
couplesforequality.com
-
pitchbop.com
-
minipresspaperco.com
-
venoam.com
-
so-paradise.com
-
surgeryprovider.com
-
donaldscareers.com
-
disney-funlife.com
-
biosolo.net
-
themodsmith.net
-
grandhawaiian.com
-
11mountains.com
-
immatesearch.com
-
stochastichq.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ - ASTROFREIGHT FEB21-0621pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ - ASTROFREIGHT FEB21-0621pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ - ASTROFREIGHT FEB21-0621pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ - ASTROFREIGHT FEB21-0621pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/344-24-0x0000000002D30000-0x0000000002D5E000-memory.dmp
memory/344-23-0x0000000000220000-0x0000000000393000-memory.dmp
memory/344-25-0x0000000004920000-0x0000000004C40000-memory.dmp
memory/344-26-0x00000000046E0000-0x0000000004773000-memory.dmp
memory/3020-27-0x0000000005FE0000-0x00000000060AE000-memory.dmp
memory/3020-20-0x0000000006520000-0x0000000006645000-memory.dmp
memory/3020-18-0x00000000063E0000-0x0000000006512000-memory.dmp
memory/3300-7-0x0000000007EE0000-0x0000000007EE1000-memory.dmp
memory/3300-2-0x0000000073300000-0x00000000739EE000-memory.dmp
memory/3300-11-0x0000000005230000-0x0000000005290000-memory.dmp
memory/3300-10-0x000000000A0F0000-0x000000000A0F1000-memory.dmp
memory/3300-9-0x0000000007ED0000-0x0000000007ED2000-memory.dmp
memory/3300-8-0x0000000007D40000-0x0000000007D41000-memory.dmp
memory/3300-6-0x0000000007CA0000-0x0000000007CA1000-memory.dmp
memory/3300-5-0x00000000080F0000-0x00000000080F1000-memory.dmp
memory/3300-3-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
memory/3916-19-0x00000000012C0000-0x00000000012D4000-memory.dmp
memory/3916-16-0x0000000001300000-0x0000000001620000-memory.dmp
memory/3916-17-0x0000000001270000-0x0000000001284000-memory.dmp
memory/3916-12-0x0000000000400000-0x000000000042E000-memory.dmp