Analysis
- max time kernel
151s - max time network
151s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
19/11/2021, 04:16
General
- Target Specifications and size of spiral panel insulated door.exe
- Size 407KB
- Sample211119-evta4scba7
- SHA256 eec7134cc1487d8774af92e127422beaadfda308d32039afaec0c815ca70dc5c
Malware Config
Extracted
-
formbook
-
4.1
-
wk31
-
http://www.firstho.com/wk31/
-
soroban.xyz
-
irfirstaid.com
-
irsaycollection.com
-
thebardownstairsasheville.com
-
facebookmeta.business
-
paypalsupportclient.com
-
metaversusfacebook.com
-
litakparuikamazon.com
-
rivianmotorcompany.com
-
metaversepro.us
-
ikramfamilypractice.com
-
bitcoinfuturesetfs.online
-
5donline.com
-
rosemount.us
-
nicole-steinfort.com
-
performanceautorepairsj.com
-
scrabblecheats.us
-
kjg67amazon.com
-
formerlyknownasfacebook.com
-
youtubeandgooglepay.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Specifications and size of spiral panel insulated door.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2208-139-0x0000000000B70000-0x0000000000C04000-memory.dmp
memory/2208-138-0x0000000000E00000-0x0000000001120000-memory.dmp
memory/2208-135-0x0000000001310000-0x000000000131B000-memory.dmp
memory/2208-136-0x00000000003C0000-0x00000000003EF000-memory.dmp
memory/3044-133-0x0000000002570000-0x000000000266C000-memory.dmp
memory/3044-140-0x0000000005F30000-0x00000000060AF000-memory.dmp
memory/3504-124-0x00000000056E0000-0x00000000056E6000-memory.dmp
memory/3504-127-0x0000000007C90000-0x0000000007CF4000-memory.dmp
memory/3504-126-0x00000000079F0000-0x00000000079F1000-memory.dmp
memory/3504-125-0x0000000007A80000-0x0000000007A81000-memory.dmp
memory/3504-118-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
memory/3504-123-0x00000000052D0000-0x00000000057CE000-memory.dmp
memory/3504-122-0x0000000005350000-0x0000000005351000-memory.dmp
memory/3504-121-0x0000000005370000-0x0000000005371000-memory.dmp
memory/3504-120-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/4028-128-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4028-132-0x0000000001E00000-0x0000000001E15000-memory.dmp
memory/4028-131-0x0000000001990000-0x0000000001CB0000-memory.dmp