Analysis
- max time kernel
148s - max time network
138s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
29/11/2021, 03:25
General
- Target Quote our new Urgent order_H7790432,pdf.exe
- Size 522KB
- Sample211129-dymr3abddr
- SHA256 9ea2af324c0b6ab6493a82c59ba4f2aa56d94c5bc830f0e2b5a8288dc63747d4
Malware Config
Extracted
-
formbook
-
4.1
-
c1h5
-
http://www.coralxlix.com/c1h5/
-
ui4dev.com
-
horrycountyrealtor.com
-
abivz.icu
-
toxicwokeness.com
-
fillthegap.site
-
surprisessinside.com
-
metaversefinder.xyz
-
freeshipflowers.com
-
apacheicon.com
-
greenfootprintpros.com
-
topauonlinecasino.com
-
weqffg.site
-
bountylux.com
-
eedrvheyn.sbs
-
whiskeybentmobile.com
-
yupeg.xyz
-
thenorthwesthome.com
-
cyril.ventures
-
zukunsmart.com
-
1l7kng51j4nm.site
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quote our new Urgent order_H7790432,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Quote our new Urgent order_H7790432,pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quote our new Urgent order_H7790432,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Quote our new Urgent order_H7790432,pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quote our new Urgent order_H7790432,pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2704-117-0x0000000005950000-0x0000000005951000-memory.dmp
memory/2704-118-0x0000000005AE0000-0x0000000005AE1000-memory.dmp
memory/2704-119-0x0000000005AB0000-0x0000000005AB6000-memory.dmp
memory/2704-120-0x0000000006120000-0x0000000006121000-memory.dmp
memory/2704-121-0x00000000063C0000-0x0000000006420000-memory.dmp
memory/2704-122-0x0000000006920000-0x0000000006921000-memory.dmp
memory/2704-115-0x0000000000F80000-0x0000000000F81000-memory.dmp
memory/3020-128-0x0000000005F40000-0x000000000608B000-memory.dmp
memory/3020-135-0x0000000002710000-0x00000000027A8000-memory.dmp
memory/3500-131-0x0000000000830000-0x0000000000847000-memory.dmp
memory/3500-132-0x0000000000720000-0x000000000074F000-memory.dmp
memory/3500-133-0x00000000031A0000-0x00000000034C0000-memory.dmp
memory/3500-134-0x0000000002FA0000-0x0000000003033000-memory.dmp
memory/3916-126-0x0000000001480000-0x00000000017A0000-memory.dmp
memory/3916-127-0x0000000001400000-0x0000000001414000-memory.dmp
memory/3916-123-0x0000000000400000-0x000000000042F000-memory.dmp