Analysis
- max time kernel
149s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/03/2021, 16:18
General
- Target supporting documents.exe
- Size 927KB
- Sample210312-fsq73s1trs
- SHA256 f39b9e8c4a9aa6d8cd9f069e8a8ee81a3f666e07071f2b4673aa42633026736c
Malware Config
Extracted
-
formbook
-
http://www.the-techs.info/chue/
-
wowmovies.today
-
magentos6.com
-
bi-nav.com
-
atlantahawks.sucks
-
wluabjy.icu
-
kevableinsights.com
-
lavidaenaustralia.com
-
stonermadeapparel.net
-
sondein.com
-
cirquedusoleilartist.com
-
kanjitem.com
-
tomofalltrades.site
-
mecanico.guru
-
tech2020s.com
-
amesoneco.com
-
theawfulliar.com
-
californiaadugurus.com
-
rentalservicesolutions.com
-
fsxbhd.club
-
casino-seo.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\supporting documents.exe"C:\Users\Admin\AppData\Local\Temp\supporting documents.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\supporting documents.exe"C:\Users\Admin\AppData\Local\Temp\supporting documents.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\supporting documents.exe"C:\Users\Admin\AppData\Local\Temp\supporting documents.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\supporting documents.exe"C:\Users\Admin\AppData\Local\Temp\supporting documents.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\supporting documents.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/60-13-0x0000000000400000-0x000000000042E000-memory.dmp
memory/60-17-0x00000000015D0000-0x00000000015E4000-memory.dmp
memory/60-16-0x00000000012B0000-0x00000000015D0000-memory.dmp
memory/2092-25-0x0000000004CF0000-0x0000000004D8C000-memory.dmp
memory/2092-18-0x0000000002D70000-0x0000000002E36000-memory.dmp
memory/3192-20-0x00000000008E0000-0x00000000008EC000-memory.dmp
memory/3192-24-0x0000000003100000-0x0000000003193000-memory.dmp
memory/3192-22-0x0000000003320000-0x0000000003640000-memory.dmp
memory/3192-21-0x0000000000860000-0x000000000088E000-memory.dmp
memory/3884-9-0x0000000005800000-0x0000000005801000-memory.dmp
memory/3884-7-0x00000000056A0000-0x00000000056A1000-memory.dmp
memory/3884-6-0x0000000005B00000-0x0000000005B01000-memory.dmp
memory/3884-5-0x0000000005500000-0x0000000005501000-memory.dmp
memory/3884-2-0x0000000073A20000-0x000000007410E000-memory.dmp
memory/3884-8-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/3884-10-0x00000000054C0000-0x00000000054CC000-memory.dmp
memory/3884-12-0x0000000008580000-0x00000000085E3000-memory.dmp
memory/3884-11-0x0000000005900000-0x0000000005901000-memory.dmp
memory/3884-3-0x0000000000BB0000-0x0000000000BB1000-memory.dmp