Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 15:20
General
-
Target
Ministry of Health Kingdom of Bahrain.exe
-
Size
358KB
-
MD5
e1a110c51c33c12ee53679c40c954395
-
SHA1
361ca3b8600138c93a6cb8728ddefd7bb1be53ef
-
SHA256
ad4c2025f6a3741ba965e53a40e907b04dd1031c666e80d98afe6fd00c70239d
-
SHA512
8572c6c49eca57c0a89523df94c73eb65617687c4e89045633eeafb05f2844f6c14df7ef0e61fa05a1cae39d5fa664d8e206c6cccadcacc03d749a9b0caefdfb
Malware Config
Extracted
formbook
4.1
ey5a
http://www.puwuved.xyz/ey5a/
lygptkl.com
winsentrade.com
bluprintliving.com
yumohealth.com
cherryadulttoys.com
gianttigar.com
maxhutmacher.net
autostokyocorp.com
calvaryload.com
stixxiepix.com
j98152.com
starsky666.xyz
loadkicks.com
designauraspace.com
wwwfmcna.com
mikakonaitopsychologist.com
kristalsuaritma.com
kh180.com
kulturel.net
araveenapark.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Ministry of Health Kingdom of Bahrain.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/408-134-0x0000000000000000-mapping.dmp
-
memory/924-130-0x0000000000000000-mapping.dmp
-
memory/924-135-0x0000000004B90000-0x0000000004C24000-memory.dmpFilesize
592KB
-
memory/924-133-0x0000000004E00000-0x0000000005120000-memory.dmpFilesize
3.1MB
-
memory/924-131-0x0000000000C10000-0x0000000000F0C000-memory.dmpFilesize
3.0MB
-
memory/924-132-0x0000000000AD0000-0x0000000000AFF000-memory.dmpFilesize
188KB
-
memory/1468-128-0x0000000001100000-0x0000000001115000-memory.dmpFilesize
84KB
-
memory/1468-127-0x0000000001570000-0x0000000001890000-memory.dmpFilesize
3.1MB
-
memory/1468-124-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1468-125-0x000000000041F070-mapping.dmp
-
memory/2276-122-0x0000000008040000-0x0000000008041000-memory.dmpFilesize
4KB
-
memory/2276-115-0x0000000000EC0000-0x0000000000EC1000-memory.dmpFilesize
4KB
-
memory/2276-123-0x00000000080E0000-0x0000000008130000-memory.dmpFilesize
320KB
-
memory/2276-121-0x0000000007D10000-0x0000000007D15000-memory.dmpFilesize
20KB
-
memory/2276-120-0x00000000056B0000-0x0000000005742000-memory.dmpFilesize
584KB
-
memory/2276-119-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/2276-118-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/2276-117-0x0000000005C90000-0x0000000005C91000-memory.dmpFilesize
4KB
-
memory/2872-129-0x0000000005AC0000-0x0000000005C14000-memory.dmpFilesize
1.3MB
-
memory/2872-136-0x0000000005C20000-0x0000000005D1C000-memory.dmpFilesize
1008KB