Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en -
submitted
20-09-2021 12:13
General
-
Target
conferma SWIFT copia pdf.exe
-
Size
684KB
-
MD5
8371b3f4f53c2f7d2ac7fbc66719660b
-
SHA1
762d5507ae4c64ae0dc11098ea1f1ce5a5d8d28d
-
SHA256
a3da5c70fbe1fabaaec65ce52c8e76384e94a5937e9fd7e8515ba8a1a048b255
-
SHA512
b54474caee9cbed9910156e35a8b6b0ee6723971777e2c010d734637e42f104562b57609b20aadee66591d8d97f165d848260262c8e0d3118b3e44efbdf9ebe3
Malware Config
Extracted
formbook
4.1
n7ak
http://www.kmresults.com/n7ak/
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 3 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\conferma SWIFT copia pdf.exe"C:\Users\Admin\AppData\Local\Temp\conferma SWIFT copia pdf.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2280-122-0x0000000005020000-0x0000000005171000-memory.dmpFilesize
1.3MB
-
memory/2280-129-0x0000000002A10000-0x0000000002AFE000-memory.dmpFilesize
952KB
-
memory/3332-125-0x0000000002CA0000-0x0000000002CCE000-memory.dmpFilesize
184KB
-
memory/3332-123-0x0000000000000000-mapping.dmp
-
memory/3332-124-0x00000000003C0000-0x00000000007FF000-memory.dmpFilesize
4.2MB
-
memory/3332-127-0x0000000004B70000-0x0000000004E90000-memory.dmpFilesize
3.1MB
-
memory/3332-128-0x0000000004940000-0x00000000049D3000-memory.dmpFilesize
588KB
-
memory/3652-126-0x0000000000000000-mapping.dmp
-
memory/3900-118-0x00000000028D0000-0x00000000028D1000-memory.dmpFilesize
4KB
-
memory/3900-121-0x0000000004470000-0x0000000004484000-memory.dmpFilesize
80KB
-
memory/3900-120-0x00000000047E0000-0x0000000004B00000-memory.dmpFilesize
3.1MB
-
memory/3900-119-0x0000000010410000-0x000000001043E000-memory.dmpFilesize
184KB
-
memory/3900-117-0x0000000000000000-mapping.dmp
-
memory/3972-115-0x00000000005E0000-0x00000000005E1000-memory.dmpFilesize
4KB