Analysis
-
max time kernel
166s -
max time network
168s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-09-2021 11:20
General
-
Target
conferma SWIFT copia pdf.exe
-
Size
684KB
-
MD5
8371b3f4f53c2f7d2ac7fbc66719660b
-
SHA1
762d5507ae4c64ae0dc11098ea1f1ce5a5d8d28d
-
SHA256
a3da5c70fbe1fabaaec65ce52c8e76384e94a5937e9fd7e8515ba8a1a048b255
-
SHA512
b54474caee9cbed9910156e35a8b6b0ee6723971777e2c010d734637e42f104562b57609b20aadee66591d8d97f165d848260262c8e0d3118b3e44efbdf9ebe3
Malware Config
Extracted
formbook
4.1
n7ak
http://www.kmresults.com/n7ak/
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 3 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\conferma SWIFT copia pdf.exe"C:\Users\Admin\AppData\Local\Temp\conferma SWIFT copia pdf.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/684-70-0x0000000000000000-mapping.dmp
-
memory/832-65-0x0000000010410000-0x000000001043E000-memory.dmpFilesize
184KB
-
memory/832-64-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/832-66-0x0000000001F70000-0x0000000002273000-memory.dmpFilesize
3.0MB
-
memory/832-67-0x0000000000270000-0x0000000000284000-memory.dmpFilesize
80KB
-
memory/832-63-0x0000000000000000-mapping.dmp
-
memory/1192-75-0x0000000003D10000-0x0000000003DFC000-memory.dmpFilesize
944KB
-
memory/1192-68-0x00000000060F0000-0x0000000006290000-memory.dmpFilesize
1.6MB
-
memory/1660-60-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1660-62-0x00000000769B1000-0x00000000769B3000-memory.dmpFilesize
8KB
-
memory/2024-69-0x0000000000000000-mapping.dmp
-
memory/2024-72-0x0000000000070000-0x000000000009E000-memory.dmpFilesize
184KB
-
memory/2024-71-0x0000000000A40000-0x0000000000A66000-memory.dmpFilesize
152KB
-
memory/2024-74-0x00000000004B0000-0x0000000000543000-memory.dmpFilesize
588KB
-
memory/2024-73-0x0000000002190000-0x0000000002493000-memory.dmpFilesize
3.0MB