Analysis
- max time kernel
151s - max time network
140s - platform
windows10_x64 - resource
win10v20210408 - submitted
02/08/2021, 05:36
General
- Target SC_TR11670000.exe
- Size 1.3MB
- Sample210802-252e9vmzgn
- SHA256 3d10f4aa567f3d3c63bff345a5935ebe6365ff607d79155bdce2bc2d852b6f7f
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.bitcoin-noticias.com/fw6/
-
rashtriyasanghsewak.com
-
filestree.cloud
-
penoner.com
-
owliwant.com
-
elkincook.com
-
jhac16kaizencollection.com
-
shalomdentalavenue.com
-
hotelsbytheweek.com
-
cookwithchefcari.com
-
threattenterprises.com
-
sanookna.com
-
tlsbuilders.com
-
softandhardshop.com
-
ppr419.com
-
powertexinc.info
-
businessandhr.com
-
yiliao2020.com
-
eiman-pro.com
-
rhondarothrealtor.com
-
junk-service.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe"C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe"C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/644-114-0x0000000000020000-0x0000000000021000-memory.dmp
memory/644-116-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/644-117-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/644-118-0x0000000002420000-0x0000000002421000-memory.dmp
memory/644-119-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/644-120-0x00000000049F0000-0x0000000004EEE000-memory.dmp
memory/644-121-0x0000000000B00000-0x0000000000B0D000-memory.dmp
memory/644-122-0x00000000097E0000-0x000000000987D000-memory.dmp
memory/644-123-0x0000000004C00000-0x0000000004C2F000-memory.dmp
memory/1496-130-0x0000000000DF0000-0x0000000000E17000-memory.dmp
memory/1496-131-0x0000000000140000-0x000000000016E000-memory.dmp
memory/1496-132-0x0000000004550000-0x0000000004870000-memory.dmp
memory/1496-134-0x0000000004480000-0x0000000004513000-memory.dmp
memory/2208-127-0x0000000001090000-0x00000000010A4000-memory.dmp
memory/2208-126-0x00000000010D0000-0x00000000013F0000-memory.dmp
memory/2208-124-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2568-128-0x00000000064E0000-0x0000000006657000-memory.dmp
memory/2568-135-0x0000000000D00000-0x0000000000E14000-memory.dmp