Analysis
- max time kernel
152s - max time network
143s - platform
windows10_x64 - resource
win10-en - submitted
08/09/2021, 18:18
General
- Target pfr 80954820021.exe
- Size 702KB
- Sample210908-wxmpsaehd9
- SHA256 83b3d86539fd63f97b860e86c3e61b4e2c64dc1ff2936566d5bda292ab6e478d
Malware Config
Extracted
-
formbook
-
4.1
-
ergs
-
http://www.barry-associates.com/ergs/
-
jardineriavilanova.com
-
highkeyfashionboutique.com
-
willingtobuyyourhouse.com
-
ysfno.com
-
bjkhjzzs.com
-
hexmotif.com
-
intentionalerror.com
-
nuu-foundfreedom.com
-
catalystspeechservices.com
-
blackmybail.com
-
xntaobaozhibo.com
-
site-sozdat.online
-
45quisisanadr.com
-
ipawlove.com
-
yifa5188.com
-
admm.email
-
houseoftealbh.com
-
scale-biz.com
-
vdvppt.club
-
loveandlight.life
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pfr 80954820021.exe"C:\Users\Admin\AppData\Local\Temp\pfr 80954820021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pfr 80954820021.exe"C:\Users\Admin\AppData\Local\Temp\pfr 80954820021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pfr 80954820021.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1036-135-0x00000000031A0000-0x0000000003233000-memory.dmp
memory/1036-134-0x0000000002E80000-0x00000000031A0000-memory.dmp
memory/1036-132-0x0000000000B00000-0x0000000000B17000-memory.dmp
memory/1036-133-0x0000000000800000-0x000000000082E000-memory.dmp
memory/2964-129-0x0000000002480000-0x0000000002571000-memory.dmp
memory/2964-136-0x0000000005090000-0x000000000521D000-memory.dmp
memory/3964-125-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3964-127-0x0000000001910000-0x0000000001C30000-memory.dmp
memory/3964-128-0x0000000001C50000-0x0000000001C64000-memory.dmp
memory/3996-115-0x00000000006A0000-0x00000000006A1000-memory.dmp
memory/3996-124-0x000000000AEF0000-0x000000000AF1F000-memory.dmp
memory/3996-123-0x0000000008790000-0x00000000087F3000-memory.dmp
memory/3996-122-0x0000000006B00000-0x0000000006B01000-memory.dmp
memory/3996-121-0x0000000005500000-0x0000000005516000-memory.dmp
memory/3996-120-0x0000000004EF0000-0x0000000004F82000-memory.dmp
memory/3996-119-0x0000000005030000-0x0000000005031000-memory.dmp
memory/3996-118-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/3996-117-0x0000000005560000-0x0000000005561000-memory.dmp