Analysis
- max time kernel
150s - max time network
134s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
22/09/2021, 14:08
General
- Target bankzx.exe
- Size 755KB
- Sample210922-rfkrmsfdhr
- SHA256 7024147e75938acd54b804df172c63b57c794e1980632c5f8190ae1e9d0da82a
Malware Config
Extracted
-
formbook
-
4.1
-
bckt
-
http://www.picnictablecompany.com/bckt/
-
termoindustrias.com
-
vcjcfw.com
-
digitalmoutain.com
-
outtanowhereentertainment.com
-
kcreative.design
-
tea-mails.com
-
xn--ob0b23la.com
-
lanyard-for-keys.com
-
luoyuanqiong.com
-
goxhome.com
-
spryandhonner.com
-
sheltrd.com
-
aagamdahale.com
-
charlie-fendius.com
-
zekesky.com
-
bills360hub.com
-
byrsmith.com
-
emaxpk.com
-
waterproofselection.com
-
primelab.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bankzx.exe"C:\Users\Admin\AppData\Local\Temp\bankzx.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bankzx.exe"C:\Users\Admin\AppData\Local\Temp\bankzx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\bankzx.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/584-71-0x0000000001F60000-0x0000000001FF3000-memory.dmp
memory/584-70-0x0000000002050000-0x0000000002353000-memory.dmp
memory/584-68-0x0000000000080000-0x00000000000AF000-memory.dmp
memory/584-67-0x0000000000480000-0x0000000000489000-memory.dmp
memory/968-58-0x0000000001F60000-0x0000000001F9F000-memory.dmp
memory/968-53-0x0000000000120000-0x0000000000121000-memory.dmp
memory/968-57-0x0000000005310000-0x000000000537F000-memory.dmp
memory/968-56-0x0000000000740000-0x000000000075D000-memory.dmp
memory/968-55-0x0000000004C90000-0x0000000004C91000-memory.dmp
memory/1364-63-0x0000000003FB0000-0x0000000004063000-memory.dmp
memory/1364-65-0x0000000006FE0000-0x000000000717D000-memory.dmp
memory/1364-72-0x0000000007C20000-0x0000000007D6F000-memory.dmp
memory/1600-61-0x0000000000810000-0x0000000000B13000-memory.dmp
memory/1600-62-0x0000000000540000-0x0000000000554000-memory.dmp
memory/1600-64-0x0000000000580000-0x0000000000594000-memory.dmp
memory/1600-59-0x0000000000400000-0x000000000042F000-memory.dmp