Analysis
- max time kernel
148s - max time network
142s - platform
windows7_x64 - resource
win7v20210410 - submitted
13/07/2021, 06:57
General
- Target 6660020210712_0-00010.XLS.exe
- Size 819KB
- Sample210713-2ra5nexcg2
- SHA256 031af74c61339ca40eda7563268d9e2e2803064c141d3c46eb20acad3764f4cc
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.setuseny.site/wz6a/
-
commonebisu.com
-
onlinedatingforyou.com
-
nomoreink.com
-
directcare.doctor
-
protego1.com
-
buvettechamonix.com
-
dissertationshelp.net
-
theawakenedmother.life
-
leonwickham.com
-
renaultstoreiran.com
-
lsxwsj.com
-
uniontattoosupply.com
-
herfitnessandbeauty.com
-
jesselynleephotography.com
-
imaginebyccp.com
-
athomeproductive.com
-
laratome.com
-
smoothsailingexpress.com
-
freedrumlessons4u.com
-
easylivego.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1196-76-0x0000000005110000-0x00000000051CF000-memory.dmp
memory/1196-69-0x0000000004AE0000-0x0000000004BF4000-memory.dmp
memory/1524-68-0x0000000000180000-0x0000000000194000-memory.dmp
memory/1524-67-0x0000000000BA0000-0x0000000000EA3000-memory.dmp
memory/1524-65-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1648-73-0x0000000000070000-0x000000000009E000-memory.dmp
memory/1648-74-0x00000000021F0000-0x00000000024F3000-memory.dmp
memory/1648-72-0x0000000000DC0000-0x0000000000DE2000-memory.dmp
memory/1648-75-0x00000000009D0000-0x0000000000A63000-memory.dmp
memory/1748-64-0x0000000000490000-0x00000000004C5000-memory.dmp
memory/1748-63-0x0000000005C50000-0x0000000005CC9000-memory.dmp
memory/1748-62-0x0000000000260000-0x0000000000270000-memory.dmp
memory/1748-59-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/1748-61-0x0000000004E80000-0x0000000004E81000-memory.dmp