Analysis
- max time kernel
149s - max time network
178s - platform
windows7_x64 - resource
win7v20210410 - submitted
22/07/2021, 12:40
General
- Target #6495PI-29458-2020.exe
- Size 919KB
- Sample210722-fbsecmtk96
- SHA256 24e635e80cecd03066225b27fdb524c4542586b22dc820e05f8a02072008c674
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.nouolive.com/wt5i/
-
mydreamct.com
-
vadicore.com
-
choicemango.com
-
projectsolutionspro.com
-
ncg.xyz
-
goio.digital
-
ee-secure-account.com
-
criminalstudy.com
-
fsjuanzhi.com
-
pont-travaux-public.com
-
agencepartenaire.com
-
jlsyzm.com
-
prosselius.com
-
woodendgroups.com
-
thereproducts.site
-
sigmagrupo.net
-
chelseagracia.com
-
fusosstore.com
-
chrissypips.trade
-
mvlxplcswa.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\#6495PI-29458-2020.exe"C:\Users\Admin\AppData\Local\Temp\#6495PI-29458-2020.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\#6495PI-29458-2020.exe"{path}"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\#6495PI-29458-2020.exe"{path}"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\#6495PI-29458-2020.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\#6495PI-29458-2020.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/608-77-0x0000000000750000-0x00000000007E3000-memory.dmp
memory/608-76-0x0000000002180000-0x0000000002483000-memory.dmp
memory/608-75-0x0000000000080000-0x00000000000AE000-memory.dmp
memory/608-74-0x0000000000D70000-0x0000000000D7A000-memory.dmp
memory/608-72-0x0000000075D41000-0x0000000075D43000-memory.dmp
memory/876-69-0x00000000001D0000-0x00000000001E4000-memory.dmp
memory/876-68-0x0000000000A40000-0x0000000000D43000-memory.dmp
memory/876-66-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1140-59-0x00000000000C0000-0x00000000000C1000-memory.dmp
memory/1140-65-0x0000000001F90000-0x0000000001FC0000-memory.dmp
memory/1140-64-0x0000000005A10000-0x0000000005A8F000-memory.dmp
memory/1140-63-0x0000000000670000-0x0000000000672000-memory.dmp
memory/1140-62-0x0000000004930000-0x0000000004931000-memory.dmp
memory/1140-61-0x0000000004300000-0x000000000435F000-memory.dmp
memory/1220-70-0x0000000004FA0000-0x00000000050AC000-memory.dmp
memory/1220-78-0x0000000004C00000-0x0000000004CBC000-memory.dmp