Analysis
- max time kernel
146s - max time network
31s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/03/2021, 15:58
General
- Target Zargbqzk.exe
- Size 736KB
- Sample210309-bmgkz89ehs
- SHA256 db351de507bfb075469e69ffe4859653ca3b3d0729c0236a5d3f8fd935e01cde
Malware Config
Extracted
-
formbook
-
http://www.electronicservicesonline.com/jsyp/
-
chernigiv-quest.com
-
s-sashenzhen.com
-
curedtherapy.com
-
esketamine.doctor
-
advantagehail.com
-
greensolartechinternet.com
-
omaybread.com
-
afrocanlinks.com
-
luisxe.info
-
qygmuakh.club
-
mutlulukdileriz.net
-
lifelineglobalministries.today
-
aaa1roofing.com
-
bestcoworker.com
-
exclusiveoffer.bet
-
answerwill.com
-
canelonni.com
-
getuvewedre.com
-
mrhotelsthailand.com
-
brabantinecityrow.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Zargbqzk.exe"C:\Users\Admin\AppData\Local\Temp\Zargbqzk.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Zargbqzk.exeC:\Users\Admin\AppData\Local\Temp\Zargbqzk.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Zargbqzk.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/672-5-0x000007FEF7F70000-0x000007FEF81EA000-memory.dmp
memory/1192-11-0x0000000004A70000-0x0000000004B65000-memory.dmp
memory/1192-13-0x0000000006650000-0x00000000067E4000-memory.dmp
memory/1384-15-0x000000004A170000-0x000000004A1BC000-memory.dmp
memory/1384-17-0x0000000002190000-0x0000000002493000-memory.dmp
memory/1384-16-0x0000000000080000-0x00000000000AE000-memory.dmp
memory/1384-19-0x0000000000590000-0x0000000000623000-memory.dmp
memory/1856-4-0x00000000767E1000-0x00000000767E3000-memory.dmp
memory/1856-2-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1856-3-0x0000000000280000-0x00000000002BB000-memory.dmp
memory/1864-10-0x0000000000670000-0x0000000000684000-memory.dmp
memory/1864-9-0x0000000000700000-0x0000000000A03000-memory.dmp
memory/1864-6-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1864-12-0x00000000006C0000-0x00000000006D4000-memory.dmp