Analysis
- max time kernel
150s - max time network
133s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
20/10/2021, 22:22
General
- Target S.O.A.exe
- Size 813KB
- Sample211020-198j8saedp
- SHA256 e6cb9330e6bbd16bdd58aac76070200e17389a45c4aead703d4ab970038ff8a2
Malware Config
Extracted
-
formbook
-
4.1
-
snr6
-
http://www.reynbetgirisi.com/snr6/
-
jjglassmi1.com
-
vpsseattle.com
-
drfllc.top
-
staycoolonline.com
-
eptlove.com
-
solusimatasehat.site
-
ionrarecharlestonproperties.com
-
b3eflucg.xyz
-
tvchosun-usa.com
-
mmahzxwzsadqlshop.life
-
gospelimport.com
-
demoapps.website
-
jackburst54.com
-
99rocket.education
-
ccbwithbri.com
-
trapperairsoft.com
-
useroadly.com
-
ralphlaurenonline-nl.com
-
loanmaster4u.com
-
champ-beauty-tomigaoka-nail.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 49 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\S.O.A.exe"C:\Users\Admin\AppData\Local\Temp\S.O.A.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\S.O.A.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\S.O.A.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2320-122-0x0000000005C90000-0x0000000005C91000-memory.dmp
memory/2320-118-0x0000000005A30000-0x0000000005A31000-memory.dmp
memory/2320-119-0x0000000005FD0000-0x0000000005FD1000-memory.dmp
memory/2320-120-0x0000000005AD0000-0x0000000005AD1000-memory.dmp
memory/2320-121-0x00000000056E0000-0x00000000056E1000-memory.dmp
memory/2320-123-0x0000000005D70000-0x0000000005D7E000-memory.dmp
memory/2320-124-0x00000000094C0000-0x0000000009540000-memory.dmp
memory/2320-125-0x000000000BCC0000-0x000000000BCF0000-memory.dmp
memory/2320-117-0x0000000003000000-0x0000000003001000-memory.dmp
memory/2320-115-0x0000000000D60000-0x0000000000D61000-memory.dmp
memory/3040-131-0x0000000006650000-0x00000000067B4000-memory.dmp
memory/3040-138-0x0000000002E80000-0x0000000002F1C000-memory.dmp
memory/4552-134-0x0000000000360000-0x0000000000387000-memory.dmp
memory/4552-135-0x0000000002830000-0x000000000285F000-memory.dmp
memory/4552-136-0x0000000004950000-0x0000000004C70000-memory.dmp
memory/4552-137-0x0000000004790000-0x0000000004823000-memory.dmp
memory/4624-130-0x0000000000FA0000-0x0000000000FB4000-memory.dmp
memory/4624-128-0x00000000011B0000-0x00000000014D0000-memory.dmp
memory/4624-126-0x0000000000400000-0x000000000042F000-memory.dmp