Analysis
- max time kernel
146s - max time network
135s - platform
windows7_x64 - resource
win7v20210410 - submitted
02/08/2021, 05:36
General
- Target SC_TR11670000.exe
- Size 1.3MB
- Sample210802-252e9vmzgn
- SHA256 3d10f4aa567f3d3c63bff345a5935ebe6365ff607d79155bdce2bc2d852b6f7f
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.bitcoin-noticias.com/fw6/
-
rashtriyasanghsewak.com
-
filestree.cloud
-
penoner.com
-
owliwant.com
-
elkincook.com
-
jhac16kaizencollection.com
-
shalomdentalavenue.com
-
hotelsbytheweek.com
-
cookwithchefcari.com
-
threattenterprises.com
-
sanookna.com
-
tlsbuilders.com
-
softandhardshop.com
-
ppr419.com
-
powertexinc.info
-
businessandhr.com
-
yiliao2020.com
-
eiman-pro.com
-
rhondarothrealtor.com
-
junk-service.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe"C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe"C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/552-75-0x0000000000980000-0x0000000000A13000-memory.dmp
memory/552-73-0x00000000000C0000-0x00000000000EE000-memory.dmp
memory/552-72-0x0000000001F60000-0x0000000002263000-memory.dmp
memory/552-71-0x0000000000B50000-0x0000000000B5D000-memory.dmp
memory/1096-65-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1096-67-0x00000000008D0000-0x0000000000BD3000-memory.dmp
memory/1096-69-0x00000000001D0000-0x00000000001E4000-memory.dmp
memory/1288-68-0x0000000005080000-0x0000000005158000-memory.dmp
memory/1288-76-0x0000000006A20000-0x0000000006B69000-memory.dmp
memory/1420-59-0x0000000000F30000-0x0000000000F31000-memory.dmp
memory/1420-64-0x0000000000740000-0x000000000076F000-memory.dmp
memory/1420-63-0x000000000BB20000-0x000000000BBBD000-memory.dmp
memory/1420-62-0x0000000000370000-0x000000000037D000-memory.dmp
memory/1420-61-0x00000000050E0000-0x00000000050E1000-memory.dmp