Analysis
- max time kernel
152s - max time network
164s - platform
windows10_x64 - resource
win10v20210408 - submitted
07/10/2021, 19:13
General
- Target obizx.exe
- Size 1019KB
- Sample211007-xw29hsdafq
- SHA256 dfbb8dc13848a4763fddee0be94415ef938755656c54e3f151995e2d50f251dc
Malware Config
Extracted
-
formbook
-
4.1
-
fkt8
-
http://www.grampianscottages.com/fkt8/
-
chosenvoicesrising.com
-
sinanbodur.com
-
ajayforchange.com
-
ucp.coffee
-
voteyatooma.com
-
budgetsignsco.com
-
greenscheme.xyz
-
bscvbuye.xyz
-
onlineslot.website
-
posta-sk-online.com
-
lawrencesmithart.com
-
clubbiohack.com
-
rancrypto.net
-
ankitanandroy.com
-
mdexam.info
-
rochx7.com
-
experiencegreatness.site
-
rooferseeker.com
-
xy-marine.com
-
tecnograss.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\obizx.exe"C:\Users\Admin\AppData\Local\Temp\obizx.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\obizx.exe"C:\Users\Admin\AppData\Local\Temp\obizx.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\obizx.exe"C:\Users\Admin\AppData\Local\Temp\obizx.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\obizx.exe"C:\Users\Admin\AppData\Local\Temp\obizx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\obizx.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/804-114-0x0000000000940000-0x0000000000941000-memory.dmp
memory/804-116-0x0000000005830000-0x0000000005831000-memory.dmp
memory/804-117-0x0000000005280000-0x0000000005281000-memory.dmp
memory/804-118-0x0000000005330000-0x000000000582E000-memory.dmp
memory/804-119-0x00000000053F0000-0x00000000053F1000-memory.dmp
memory/804-120-0x00000000057E0000-0x00000000057F1000-memory.dmp
memory/804-121-0x0000000007660000-0x0000000007661000-memory.dmp
memory/804-122-0x00000000078E0000-0x0000000007931000-memory.dmp
memory/2188-130-0x0000000001340000-0x000000000177F000-memory.dmp
memory/2188-131-0x00000000006C0000-0x00000000006EF000-memory.dmp
memory/2188-133-0x0000000004B80000-0x0000000004EA0000-memory.dmp
memory/2188-134-0x0000000001180000-0x0000000001213000-memory.dmp
memory/3056-128-0x00000000057D0000-0x00000000058D5000-memory.dmp
memory/3056-135-0x0000000003290000-0x0000000003346000-memory.dmp
memory/3912-127-0x00000000015D0000-0x00000000015E4000-memory.dmp
memory/3912-126-0x0000000001610000-0x0000000001930000-memory.dmp
memory/3912-123-0x0000000000400000-0x000000000042F000-memory.dmp