Analysis
- max time kernel
155s - max time network
151s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
08/10/2021, 04:39
General
- Target Se adjunta estado de cuenta.exe
- Size 774KB
- Sample211008-e9y5xaddcl
- SHA256 5d94a08cddf84ab11cc26e7e8531a04bab46f9ddf44c1ccd7e38a269ffdfaad0
Malware Config
Extracted
-
formbook
-
4.1
-
bc3s
-
http://www.topei-products.com/bc3s/
-
anna-ng.com
-
mariangelamata.com
-
szqnbl.com
-
nesherguitars.com
-
mysekrit.com
-
againbeautyviensui.xyz
-
appf.life
-
bilalsolution.com
-
technoratii.com
-
11restoran.com
-
birthingly.com
-
crystalcarrillo.com
-
cohenasset.info
-
bunchofdesign.com
-
highstreetmag.com
-
talentkerning.com
-
outdoor-glassesadvice.com
-
aliceeety.com
-
habbuhot.info
-
pao91.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Se adjunta estado de cuenta.exe"C:\Users\Admin\AppData\Local\Temp\Se adjunta estado de cuenta.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mobsync.exeC:\Windows\System32\mobsync.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\mobsync.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2072-116-0x0000000000670000-0x0000000000671000-memory.dmp
memory/2072-115-0x0000000000831000-0x0000000000845000-memory.dmp
memory/3068-123-0x0000000000CE0000-0x0000000000DB3000-memory.dmp
memory/3068-133-0x0000000006790000-0x000000000684B000-memory.dmp
memory/3068-126-0x0000000002C30000-0x0000000002D04000-memory.dmp
memory/3132-124-0x0000000072480000-0x00000000724AE000-memory.dmp
memory/3132-122-0x0000000000910000-0x0000000000924000-memory.dmp
memory/3132-121-0x0000000004470000-0x0000000004790000-memory.dmp
memory/3132-119-0x0000000072480000-0x00000000724AE000-memory.dmp
memory/3132-125-0x0000000000950000-0x0000000000964000-memory.dmp
memory/3132-118-0x0000000000650000-0x0000000000651000-memory.dmp
memory/3988-129-0x0000000000A00000-0x0000000000A2E000-memory.dmp
memory/3988-128-0x0000000000A90000-0x0000000000A9C000-memory.dmp
memory/3988-131-0x0000000003590000-0x00000000038B0000-memory.dmp
memory/3988-132-0x0000000003240000-0x00000000032D3000-memory.dmp