Analysis
- max time kernel
149s - max time network
139s - platform
windows10_x64 - resource
win10v20201028 - submitted
01/03/2021, 07:28
General
- Target PO#3043.pdf.exe
- Size 1.0MB
- Sample210301-2wjdn99q3e
- SHA256 6e10193dd3318172ee57476a036b6078a1576ed3f8dcdff72a3991dc563c2d34
Malware Config
Extracted
-
formbook
-
http://www.intelliedgeclinical.net/god/
-
aprendiz.digital
-
baby-rosy.com
-
buzzstreetnews.com
-
restoredscore.com
-
fullbeingphysician.com
-
gameonaustralia.com
-
famdns.com
-
compassionatecare-llc.com
-
yureb.com
-
bike-abruzzo.com
-
hibiskuricity.site
-
hindusetu.com
-
searchingkitsapcountyhomes.com
-
trespal.com
-
forenvid.com
-
gangnamstationithacany.com
-
roshan-prime.com
-
fsmstudio.com
-
bilecikvinckiralama.com
-
cash4urhousekeys.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO#3043.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO#3043.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO#3043.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO#3043.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO#3043.pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1148-3-0x0000000000C00000-0x0000000000C01000-memory.dmp
memory/1148-5-0x00000000055B0000-0x00000000055B1000-memory.dmp
memory/1148-6-0x0000000005BC0000-0x0000000005BC1000-memory.dmp
memory/1148-7-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/1148-8-0x0000000005510000-0x0000000005511000-memory.dmp
memory/1148-9-0x0000000005650000-0x0000000005651000-memory.dmp
memory/1148-10-0x000000000A2C0000-0x000000000E2BD000-memory.dmp
memory/1148-11-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/1148-12-0x0000000005A30000-0x0000000005A85000-memory.dmp
memory/1148-2-0x0000000073450000-0x0000000073B3E000-memory.dmp
memory/2648-13-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2648-17-0x00000000017B0000-0x0000000001AD0000-memory.dmp
memory/2648-18-0x0000000001460000-0x0000000001474000-memory.dmp
memory/2784-23-0x0000000000BD0000-0x0000000000BFE000-memory.dmp
memory/2784-22-0x0000000000EE0000-0x000000000131F000-memory.dmp
memory/2784-24-0x0000000005130000-0x0000000005450000-memory.dmp
memory/2784-25-0x0000000005450000-0x00000000054E3000-memory.dmp
memory/3044-19-0x0000000005EA0000-0x0000000005FCF000-memory.dmp
memory/3044-26-0x0000000005FD0000-0x000000000611D000-memory.dmp