Analysis
- max time kernel
154s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
09/12/2021, 08:21
General
- Target PO21120008.PDF.exe
- Size 1.0MB
- Sample211209-j81dssbba3
- SHA256 bf4e018e1442fb7815901e53bccc699ee5634e2fcc3ba73327e123ae3d89a65b
Malware Config
Extracted
-
formbook
-
4.1
-
gr1c
-
http://www.illusiontrick.com/gr1c/
-
soakyourgrains.com
-
duwego.com
-
aenkdesign.com
-
bikabbziu.xyz
-
thesawyerlegacy.com
-
koreanmodelbj.xyz
-
exceed-standards.com
-
syirsve.com
-
sachisushimontreal.com
-
thegalwaykitchen.com
-
accarwash-hub.com
-
connectwithmentor.com
-
luftfundament.online
-
ibrahimkaracan.com
-
biggersinsurance.com
-
desellon.com
-
tvnewscloset.com
-
digital-dre.com
-
ingocg.com
-
fernanda-ortiz.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO21120008.PDF.exe"C:\Users\Admin\AppData\Local\Temp\PO21120008.PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO21120008.PDF.exe"C:\Users\Admin\AppData\Local\Temp\PO21120008.PDF.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PO21120008.PDF.exe"C:\Users\Admin\AppData\Local\Temp\PO21120008.PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO21120008.PDF.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2476-118-0x0000000005D60000-0x0000000005D61000-memory.dmp
memory/2476-119-0x0000000005940000-0x0000000005941000-memory.dmp
memory/2476-120-0x0000000005860000-0x0000000005D5E000-memory.dmp
memory/2476-121-0x0000000005900000-0x0000000005901000-memory.dmp
memory/2476-122-0x0000000005A70000-0x0000000005A77000-memory.dmp
memory/2476-123-0x0000000005C80000-0x0000000005C81000-memory.dmp
memory/2476-124-0x000000000A250000-0x000000000A251000-memory.dmp
memory/2476-125-0x000000000A2F0000-0x000000000A40D000-memory.dmp
memory/2476-116-0x0000000000E80000-0x0000000000E81000-memory.dmp
memory/3056-131-0x0000000005880000-0x000000000598E000-memory.dmp
memory/3056-138-0x0000000003120000-0x00000000031EE000-memory.dmp
memory/3416-129-0x00000000018D0000-0x0000000001BF0000-memory.dmp
memory/3416-130-0x0000000001880000-0x0000000001894000-memory.dmp
memory/3416-126-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3420-136-0x0000000003350000-0x0000000003670000-memory.dmp
memory/3420-135-0x0000000000910000-0x000000000093F000-memory.dmp
memory/3420-134-0x0000000000FE0000-0x0000000000FF7000-memory.dmp
memory/3420-137-0x0000000003250000-0x00000000032E3000-memory.dmp