Analysis
- max time kernel
155s - max time network
145s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
10/11/2021, 18:21
General
- Target INQUIRY SUBMITTAL_ADM SWITZERLAND.exe
- Size 542KB
- Sample211110-wza4rsaaa5
- SHA256 fcaa502268e22400e98ae6f0842b7cf3598cf5a920c09a0d74996bdb64add249
Malware Config
Extracted
-
formbook
-
4.1
-
g8ni
-
http://www.er5544.com/g8ni/
-
nickmowat.com
-
garethjame.biz
-
colibrilift.com
-
vulnerabilitylabs.one
-
neuro-ai-web-ru.website
-
16mcnaestreetmooneeponds.com
-
bestofstmaarten.net
-
meditelier.com
-
ragnarduke.com
-
escueladecampo.com
-
vongtayvn.com
-
inmemoriamaan.com
-
yourpeoplemanager.com
-
r6-gytr.com
-
agreeablebeauty.com
-
snpconfirms.com
-
tribalurq.quest
-
purafuse.com
-
cisco-training-course.com
-
wery.top
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 4 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\INQUIRY SUBMITTAL_ADM SWITZERLAND.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2552-134-0x0000000003400000-0x0000000003414000-memory.dmp
memory/2552-133-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2552-130-0x0000000001730000-0x0000000001A50000-memory.dmp
memory/2552-131-0x0000000001B40000-0x0000000001B54000-memory.dmp
memory/2552-127-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3020-142-0x0000000005480000-0x00000000055BD000-memory.dmp
memory/3020-135-0x0000000002CF0000-0x0000000002DA2000-memory.dmp
memory/3020-132-0x00000000027A0000-0x0000000002864000-memory.dmp
memory/3128-138-0x0000000003110000-0x000000000313F000-memory.dmp
memory/3128-137-0x0000000000D10000-0x000000000100C000-memory.dmp
memory/3128-140-0x00000000048C0000-0x0000000004BE0000-memory.dmp
memory/3128-141-0x0000000004C80000-0x0000000004D13000-memory.dmp
memory/3380-121-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/3380-126-0x0000000007C30000-0x0000000007C7C000-memory.dmp
memory/3380-125-0x0000000007C80000-0x0000000007C81000-memory.dmp
memory/3380-124-0x0000000005900000-0x0000000005907000-memory.dmp
memory/3380-118-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/3380-123-0x00000000054B0000-0x00000000054B1000-memory.dmp
memory/3380-120-0x0000000005AD0000-0x0000000005AD1000-memory.dmp
memory/3380-122-0x00000000055D0000-0x0000000005ACE000-memory.dmp