Analysis
-
max time kernel
300s -
max time network
286s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
16-09-2021 17:06
General
-
Target
inductothermindia.exe
-
Size
487KB
-
MD5
ba1672ded82ad0202c4a942129279d6f
-
SHA1
5e9f62fdc033050802fa58d50e6216fdddf8d746
-
SHA256
8daea2a88b107bafc48119beeb68e3f8ea56a645190851150cff84e97a38ee2b
-
SHA512
d52d5a9c5e580c64af68cbd375fa5ffa6e4eb4917fa3ae375fac6fa87c77b7c8f711524ee47d8f7ee10a5a185fc2b192e51ac00bfbd7cb58b1a91fbeb98b80b7
Malware Config
Extracted
formbook
4.1
pm7s
http://www.rafaelcristino.com/pm7s/
angrypeacocks.site
theindependentartlable.com
coachingforthewin.com
localbizsc.com
drive-a-supercar.com
mewsette.com
scinuh.com
gurugramaffordablehomes.com
riamedefarm.com
richfitzfashions.com
u9j1o.info
dife-rent.com
talesfromthequadrat.com
dandfmotors.com
springtexasdentist.com
gobakala.store
earlyeducationglobal.com
sdrxsb.site
dreamlifebiz.com
theurbancaveshop.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inductothermindia.exe"C:\Users\Admin\AppData\Local\Temp\inductothermindia.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inductothermindia.exe"C:\Users\Admin\AppData\Local\Temp\inductothermindia.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\inductothermindia.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-114-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/532-116-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/532-117-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/532-118-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/532-119-0x0000000005320000-0x000000000581E000-memory.dmpFilesize
5.0MB
-
memory/532-120-0x0000000009AC0000-0x0000000009AC7000-memory.dmpFilesize
28KB
-
memory/532-121-0x0000000009B80000-0x0000000009B81000-memory.dmpFilesize
4KB
-
memory/532-122-0x0000000009FB0000-0x000000000A015000-memory.dmpFilesize
404KB
-
memory/532-123-0x000000000A060000-0x000000000A08F000-memory.dmpFilesize
188KB
-
memory/844-125-0x000000000041EC00-mapping.dmp
-
memory/844-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/844-126-0x0000000001090000-0x00000000013B0000-memory.dmpFilesize
3.1MB
-
memory/844-127-0x0000000000FD0000-0x0000000000FE4000-memory.dmpFilesize
80KB
-
memory/1188-129-0x0000000000000000-mapping.dmp
-
memory/1188-131-0x0000000002AD0000-0x0000000002AFE000-memory.dmpFilesize
184KB
-
memory/1188-130-0x0000000000390000-0x00000000007CF000-memory.dmpFilesize
4.2MB
-
memory/1188-133-0x00000000047A0000-0x0000000004AC0000-memory.dmpFilesize
3.1MB
-
memory/1188-134-0x0000000004600000-0x0000000004693000-memory.dmpFilesize
588KB
-
memory/1412-132-0x0000000000000000-mapping.dmp
-
memory/2988-128-0x00000000060F0000-0x00000000061F8000-memory.dmpFilesize
1.0MB
-
memory/2988-135-0x0000000006200000-0x0000000006355000-memory.dmpFilesize
1.3MB