Analysis
- max time kernel
150s - max time network
145s - platform
windows10_x64 - resource
win10v20210410 - submitted
13/07/2021, 06:57
General
- Target 6660020210712_0-00010.XLS.exe
- Size 819KB
- Sample210713-2ra5nexcg2
- SHA256 031af74c61339ca40eda7563268d9e2e2803064c141d3c46eb20acad3764f4cc
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.setuseny.site/wz6a/
-
commonebisu.com
-
onlinedatingforyou.com
-
nomoreink.com
-
directcare.doctor
-
protego1.com
-
buvettechamonix.com
-
dissertationshelp.net
-
theawakenedmother.life
-
leonwickham.com
-
renaultstoreiran.com
-
lsxwsj.com
-
uniontattoosupply.com
-
herfitnessandbeauty.com
-
jesselynleephotography.com
-
imaginebyccp.com
-
athomeproductive.com
-
laratome.com
-
smoothsailingexpress.com
-
freedrumlessons4u.com
-
easylivego.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\6660020210712_0-00010.XLS.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3020-129-0x0000000005810000-0x000000000592A000-memory.dmp
memory/3020-136-0x0000000003080000-0x0000000003145000-memory.dmp
memory/3212-121-0x0000000004EC0000-0x00000000053BE000-memory.dmp
memory/3212-119-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3212-120-0x00000000050E0000-0x00000000050E1000-memory.dmp
memory/3212-118-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
memory/3212-122-0x0000000004830000-0x0000000004840000-memory.dmp
memory/3212-123-0x00000000075A0000-0x0000000007619000-memory.dmp
memory/3212-124-0x0000000007620000-0x0000000007655000-memory.dmp
memory/3212-114-0x00000000004C0000-0x00000000004C1000-memory.dmp
memory/3212-117-0x00000000053C0000-0x00000000053C1000-memory.dmp
memory/3212-116-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/3456-125-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3456-127-0x0000000001010000-0x0000000001330000-memory.dmp
memory/3456-128-0x0000000000FB0000-0x0000000000FC4000-memory.dmp
memory/3956-132-0x0000000000740000-0x000000000076E000-memory.dmp
memory/3956-131-0x0000000001030000-0x0000000001049000-memory.dmp
memory/3956-134-0x0000000004920000-0x0000000004C40000-memory.dmp
memory/3956-135-0x0000000004860000-0x00000000048F3000-memory.dmp