Analysis
- max time kernel
149s - max time network
139s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
09/11/2021, 12:58
General
- Target PO#101581.exe
- Size 591KB
- Sample211109-p7hegsfce2
- SHA256 dbf442323e19a477370d316dbbd389f48ce8c93ebd119fdb319be4f3f82d4b7f
Malware Config
Extracted
-
formbook
-
4.1
-
snr6
-
http://www.reynbetgirisi.com/snr6/
-
jjglassmi1.com
-
vpsseattle.com
-
drfllc.top
-
staycoolonline.com
-
eptlove.com
-
solusimatasehat.site
-
ionrarecharlestonproperties.com
-
b3eflucg.xyz
-
tvchosun-usa.com
-
mmahzxwzsadqlshop.life
-
gospelimport.com
-
demoapps.website
-
jackburst54.com
-
99rocket.education
-
ccbwithbri.com
-
trapperairsoft.com
-
useroadly.com
-
ralphlaurenonline-nl.com
-
loanmaster4u.com
-
champ-beauty-tomigaoka-nail.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO#101581.exe"C:\Users\Admin\AppData\Local\Temp\PO#101581.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO#101581.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO#101581.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/372-140-0x00000000049F0000-0x0000000004A83000-memory.dmp
memory/372-139-0x0000000004AF0000-0x0000000004E10000-memory.dmp
memory/372-136-0x0000000000890000-0x0000000000896000-memory.dmp
memory/372-137-0x00000000030D0000-0x00000000030FF000-memory.dmp
memory/2436-134-0x0000000005A20000-0x0000000005B6E000-memory.dmp
memory/2436-141-0x00000000031A0000-0x0000000003292000-memory.dmp
memory/4024-124-0x0000000004E20000-0x000000000531E000-memory.dmp
memory/4024-123-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
memory/4024-120-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/4024-121-0x0000000005320000-0x0000000005321000-memory.dmp
memory/4024-122-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/4024-128-0x000000000B0B0000-0x000000000B0E0000-memory.dmp
memory/4024-127-0x00000000088C0000-0x0000000008942000-memory.dmp
memory/4024-126-0x00000000050D0000-0x00000000050DE000-memory.dmp
memory/4024-125-0x0000000005030000-0x0000000005031000-memory.dmp
memory/4024-118-0x0000000000440000-0x0000000000441000-memory.dmp
memory/4520-132-0x0000000001900000-0x0000000001C20000-memory.dmp
memory/4520-133-0x00000000018E0000-0x00000000018F4000-memory.dmp
memory/4520-129-0x0000000000400000-0x000000000042F000-memory.dmp