Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
10-05-2021 14:44
General
-
Target
PO#6275473, Shipping.exe
-
Size
665KB
-
MD5
cb78b28dea109d0e11a05934e02cf9d8
-
SHA1
caab11bc17589dc8d20805070d1e343d60192751
-
SHA256
5f05f0816898db3798aaa6722cfbd0f625a0eac271b72d0b8c295fa056dff733
-
SHA512
8b53f9c263efd1c2ef9011de1112deac3d15d7d31cdf4061f2cca19a4a713bca873d6f0ee0778d3a7eafbbe62a23e891dea8668164f2e9d20645f0aed3a8abaa
Malware Config
Extracted
formbook
4.1
http://www.magnumopuspro.com/nyr/
anemone-vintage.com
ironcitytools.com
joshandmatthew.com
breathtakingscenery.photos
karabakh-terror.com
micahelgall.com
entretiendesterrasses.com
mhgholdings.com
blewm.com
sidewalknotary.com
ytrs-elec.com
danhpham.com
ma21cle2henz.xyz
lotusforlease.com
shipleyphotoandfilm.com
bulktool.xyz
ouedzmala.com
yichengvpr.com
connectmygames.com
chjcsc.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO#6275473, Shipping.exe"C:\Users\Admin\AppData\Local\Temp\PO#6275473, Shipping.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO#6275473, Shipping.exe"C:\Users\Admin\AppData\Local\Temp\PO#6275473, Shipping.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PO#6275473, Shipping.exe"C:\Users\Admin\AppData\Local\Temp\PO#6275473, Shipping.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO#6275473, Shipping.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
-
Filesize
80KB
-
Filesize
3.1MB
-
-
Filesize
184KB
-
Filesize
588KB
-
Filesize
3.1MB
-
Filesize
3.0MB
-
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
224KB
-
Filesize
508KB
-
Filesize
16KB
-