Analysis
- max time kernel
146s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/03/2021, 15:58
General
- Target Zargbqzk.exe
- Size 736KB
- Sample210309-bmgkz89ehs
- SHA256 db351de507bfb075469e69ffe4859653ca3b3d0729c0236a5d3f8fd935e01cde
Malware Config
Extracted
-
formbook
-
http://www.electronicservicesonline.com/jsyp/
-
chernigiv-quest.com
-
s-sashenzhen.com
-
curedtherapy.com
-
esketamine.doctor
-
advantagehail.com
-
greensolartechinternet.com
-
omaybread.com
-
afrocanlinks.com
-
luisxe.info
-
qygmuakh.club
-
mutlulukdileriz.net
-
lifelineglobalministries.today
-
aaa1roofing.com
-
bestcoworker.com
-
exclusiveoffer.bet
-
answerwill.com
-
canelonni.com
-
getuvewedre.com
-
mrhotelsthailand.com
-
brabantinecityrow.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Zargbqzk.exe"C:\Users\Admin\AppData\Local\Temp\Zargbqzk.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Zargbqzk.exeC:\Users\Admin\AppData\Local\Temp\Zargbqzk.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Zargbqzk.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2092-10-0x00000000067E0000-0x000000000695C000-memory.dmp
memory/2092-17-0x0000000006B10000-0x0000000006C74000-memory.dmp
memory/2428-13-0x00000000012A0000-0x00000000012AB000-memory.dmp
memory/2428-14-0x0000000000E20000-0x0000000000E4E000-memory.dmp
memory/2428-15-0x00000000035E0000-0x0000000003900000-memory.dmp
memory/2428-16-0x0000000003520000-0x00000000035B3000-memory.dmp
memory/2984-8-0x0000000000BC0000-0x0000000000EE0000-memory.dmp
memory/2984-9-0x0000000000B60000-0x0000000000B74000-memory.dmp
memory/2984-4-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3888-2-0x0000000000650000-0x0000000000651000-memory.dmp
memory/3888-3-0x00000000006A0000-0x00000000006DB000-memory.dmp