Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-09-2021 12:26
General
-
Target
conferma SWIFT copia pdf.exe
-
Size
684KB
-
MD5
8371b3f4f53c2f7d2ac7fbc66719660b
-
SHA1
762d5507ae4c64ae0dc11098ea1f1ce5a5d8d28d
-
SHA256
a3da5c70fbe1fabaaec65ce52c8e76384e94a5937e9fd7e8515ba8a1a048b255
-
SHA512
b54474caee9cbed9910156e35a8b6b0ee6723971777e2c010d734637e42f104562b57609b20aadee66591d8d97f165d848260262c8e0d3118b3e44efbdf9ebe3
Malware Config
Extracted
formbook
4.1
n7ak
http://www.kmresults.com/n7ak/
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\conferma SWIFT copia pdf.exe"C:\Users\Admin\AppData\Local\Temp\conferma SWIFT copia pdf.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1212-125-0x0000000000000000-mapping.dmp
-
memory/3024-121-0x0000000005240000-0x00000000053BD000-memory.dmpFilesize
1.5MB
-
memory/3024-130-0x0000000006600000-0x00000000066F2000-memory.dmpFilesize
968KB
-
memory/3024-123-0x00000000063D0000-0x0000000006535000-memory.dmpFilesize
1.4MB
-
memory/3496-122-0x0000000004FC0000-0x0000000004FD4000-memory.dmpFilesize
80KB
-
memory/3496-119-0x0000000004B30000-0x0000000004E50000-memory.dmpFilesize
3.1MB
-
memory/3496-120-0x0000000004960000-0x0000000004974000-memory.dmpFilesize
80KB
-
memory/3496-117-0x0000000002CB0000-0x0000000002CB1000-memory.dmpFilesize
4KB
-
memory/3496-118-0x0000000010410000-0x000000001043E000-memory.dmpFilesize
184KB
-
memory/3496-116-0x0000000000000000-mapping.dmp
-
memory/3612-124-0x0000000000000000-mapping.dmp
-
memory/3612-127-0x0000000000890000-0x00000000008BE000-memory.dmpFilesize
184KB
-
memory/3612-126-0x0000000000A00000-0x0000000000E3F000-memory.dmpFilesize
4.2MB
-
memory/3612-128-0x0000000004C80000-0x0000000004FA0000-memory.dmpFilesize
3.1MB
-
memory/3612-129-0x0000000004AE0000-0x0000000004B73000-memory.dmpFilesize
588KB
-
memory/3628-114-0x00000000005B0000-0x00000000005B1000-memory.dmpFilesize
4KB