Analysis
- max time kernel
115s - max time network
124s - platform
windows10_x64 - resource
win10v20201028 - submitted
21/02/2021, 18:14
General
- Target do202120102_010010101001010.pdf.exe
- Size 883KB
- Sample210221-pspywbcmmj
- SHA256 878780dd4a45cd2ac3266e865c987933f7f6539fe93f6bc6b314188b2e5d2a45
Malware Config
Extracted
-
formbook
-
http://www.coincrush.net/fzd/
-
vn-mua-hang-onlike.site
-
creationsbylisaq.com
-
clouduwo.com
-
archlvedata.com
-
casanoriamaderas.com
-
plouceur.com
-
thrivewarrioracademy.com
-
saraviafirma.com
-
letstalktech.tech
-
rhetfox.com
-
clmssouth.com
-
thecatstits.net
-
mepain.space
-
thepapaya.xyz
-
gaplek.net
-
llcom.net
-
estrategassocial.com
-
sliming.life
-
progressofindia.com
-
fakedoctorsrealfriendsmerch.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2096-13-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2096-16-0x0000000000FD0000-0x00000000012F0000-memory.dmp
memory/4688-9-0x0000000005570000-0x0000000005571000-memory.dmp
memory/4688-7-0x0000000005410000-0x0000000005411000-memory.dmp
memory/4688-8-0x00000000052B0000-0x00000000052B1000-memory.dmp
memory/4688-2-0x0000000073900000-0x0000000073FEE000-memory.dmp
memory/4688-10-0x0000000005620000-0x0000000005621000-memory.dmp
memory/4688-11-0x0000000005840000-0x0000000005843000-memory.dmp
memory/4688-12-0x00000000075F0000-0x0000000007645000-memory.dmp
memory/4688-6-0x0000000005870000-0x0000000005871000-memory.dmp
memory/4688-5-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/4688-3-0x00000000009B0000-0x00000000009B1000-memory.dmp