Analysis
- max time kernel
148s - max time network
144s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
05/01/2022, 09:03
General
- Target 3e19b57f827e4d5df5e09cd5cc115249.exe
- Size 796KB
- Sample220105-kz15eaadhl
- SHA256 dc8c2ca84a7c5468cfb7b6bf59396e0333c8d145dc08fd1efbbebd9fa0082dd7
Malware Config
Extracted
-
formbook
-
4.1
-
g2fg
-
snowcrash.website
-
pointman.us
-
newheartvalve.care
-
drandl.com
-
sandspringsramblers.com
-
programagubernamental.online
-
boja.us
-
mvrsnike.com
-
mentallyillmotherhood.com
-
facom.us
-
programagubernamental.store
-
izivente.com
-
roller-v.fr
-
amazonbioactives.com
-
metaverseapple.xyz
-
5gt-mobilevsverizon.com
-
gtwebsolutions.co
-
scottdunn.life
-
usdp.trade
-
pikmin.run
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\3e19b57f827e4d5df5e09cd5cc115249.exe"C:\Users\Admin\AppData\Local\Temp\3e19b57f827e4d5df5e09cd5cc115249.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1076-67-0x0000000002130000-0x0000000002433000-memory.dmp
memory/1076-70-0x0000000072480000-0x00000000724AF000-memory.dmp
memory/1076-71-0x00000000001D0000-0x00000000001E4000-memory.dmp
memory/1076-68-0x0000000000150000-0x0000000000164000-memory.dmp
memory/1076-59-0x0000000072480000-0x00000000724AF000-memory.dmp
memory/1076-60-0x0000000000080000-0x0000000000081000-memory.dmp
memory/1076-64-0x0000000000090000-0x0000000000091000-memory.dmp
memory/1076-65-0x0000000072480000-0x00000000724AF000-memory.dmp
memory/1380-69-0x0000000007200000-0x000000000738D000-memory.dmp
memory/1380-72-0x0000000007390000-0x0000000007504000-memory.dmp
memory/1380-79-0x0000000007040000-0x000000000717C000-memory.dmp
memory/1652-56-0x00000000001B0000-0x00000000001B1000-memory.dmp
memory/1652-55-0x0000000074B21000-0x0000000074B23000-memory.dmp
memory/1652-58-0x00000000004D1000-0x00000000004E5000-memory.dmp
memory/1652-57-0x00000000004D0000-0x00000000004D1000-memory.dmp
memory/1784-76-0x0000000000080000-0x00000000000AF000-memory.dmp
memory/1784-77-0x0000000001FD0000-0x00000000022D3000-memory.dmp
memory/1784-75-0x00000000008F0000-0x00000000008F5000-memory.dmp
memory/1784-78-0x0000000001D00000-0x0000000001D93000-memory.dmp