Analysis
- max time kernel
151s - max time network
144s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
10/11/2021, 18:21
General
- Target INQUIRY SUBMITTAL_ADM SWITZERLAND.exe
- Size 542KB
- Sample211110-wza4rsaaa5
- SHA256 fcaa502268e22400e98ae6f0842b7cf3598cf5a920c09a0d74996bdb64add249
Malware Config
Extracted
-
formbook
-
4.1
-
g8ni
-
http://www.er5544.com/g8ni/
-
nickmowat.com
-
garethjame.biz
-
colibrilift.com
-
vulnerabilitylabs.one
-
neuro-ai-web-ru.website
-
16mcnaestreetmooneeponds.com
-
bestofstmaarten.net
-
meditelier.com
-
ragnarduke.com
-
escueladecampo.com
-
vongtayvn.com
-
inmemoriamaan.com
-
yourpeoplemanager.com
-
r6-gytr.com
-
agreeablebeauty.com
-
snpconfirms.com
-
tribalurq.quest
-
purafuse.com
-
cisco-training-course.com
-
wery.top
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1212-68-0x0000000005F50000-0x0000000006093000-memory.dmp
memory/1212-76-0x0000000003C10000-0x0000000003CB5000-memory.dmp
memory/1304-75-0x0000000002020000-0x00000000020B3000-memory.dmp
memory/1304-74-0x00000000022B0000-0x00000000025B3000-memory.dmp
memory/1304-72-0x00000000000D0000-0x00000000000FF000-memory.dmp
memory/1304-71-0x0000000000840000-0x0000000000854000-memory.dmp
memory/1616-60-0x00000000041E0000-0x000000000422C000-memory.dmp
memory/1616-55-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1616-59-0x0000000000540000-0x0000000000547000-memory.dmp
memory/1616-58-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/1616-57-0x0000000076351000-0x0000000076353000-memory.dmp
memory/1788-66-0x0000000000BE0000-0x0000000000EE3000-memory.dmp
memory/1788-67-0x0000000000140000-0x0000000000154000-memory.dmp
memory/1788-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1788-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1788-61-0x0000000000400000-0x000000000042F000-memory.dmp