Analysis
- max time kernel
147s - max time network
138s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
19/11/2021, 04:16
General
- Target Specifications and size of spiral panel insulated door.exe
- Size 407KB
- Sample211119-evta4scba7
- SHA256 eec7134cc1487d8774af92e127422beaadfda308d32039afaec0c815ca70dc5c
Malware Config
Extracted
-
formbook
-
4.1
-
wk31
-
http://www.firstho.com/wk31/
-
soroban.xyz
-
irfirstaid.com
-
irsaycollection.com
-
thebardownstairsasheville.com
-
facebookmeta.business
-
paypalsupportclient.com
-
metaversusfacebook.com
-
litakparuikamazon.com
-
rivianmotorcompany.com
-
metaversepro.us
-
ikramfamilypractice.com
-
bitcoinfuturesetfs.online
-
5donline.com
-
rosemount.us
-
nicole-steinfort.com
-
performanceautorepairsj.com
-
scrabblecheats.us
-
kjg67amazon.com
-
formerlyknownasfacebook.com
-
youtubeandgooglepay.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/520-55-0x0000000000C50000-0x0000000000C51000-memory.dmp
memory/520-57-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
memory/520-58-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
memory/520-59-0x0000000000290000-0x0000000000296000-memory.dmp
memory/520-60-0x0000000004A00000-0x0000000004A64000-memory.dmp
memory/684-75-0x00000000023B0000-0x00000000026B3000-memory.dmp
memory/684-76-0x00000000020A0000-0x0000000002134000-memory.dmp
memory/684-74-0x0000000000080000-0x00000000000AF000-memory.dmp
memory/684-73-0x00000000005F0000-0x0000000000871000-memory.dmp
memory/684-71-0x00000000754B1000-0x00000000754B3000-memory.dmp
memory/1268-77-0x0000000006DF0000-0x0000000006F0B000-memory.dmp
memory/1268-68-0x00000000073E0000-0x0000000007567000-memory.dmp
memory/1808-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1808-66-0x0000000000CC0000-0x0000000000FC3000-memory.dmp
memory/1808-67-0x00000000001F0000-0x0000000000205000-memory.dmp
memory/1808-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1808-62-0x0000000000400000-0x000000000042F000-memory.dmp