Analysis
- max time kernel
152s - max time network
137s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
05/01/2022, 09:03
General
- Target 3e19b57f827e4d5df5e09cd5cc115249.exe
- Size 796KB
- Sample220105-kz15eaadhl
- SHA256 dc8c2ca84a7c5468cfb7b6bf59396e0333c8d145dc08fd1efbbebd9fa0082dd7
Malware Config
Extracted
-
formbook
-
4.1
-
g2fg
-
snowcrash.website
-
pointman.us
-
newheartvalve.care
-
drandl.com
-
sandspringsramblers.com
-
programagubernamental.online
-
boja.us
-
mvrsnike.com
-
mentallyillmotherhood.com
-
facom.us
-
programagubernamental.store
-
izivente.com
-
roller-v.fr
-
amazonbioactives.com
-
metaverseapple.xyz
-
5gt-mobilevsverizon.com
-
gtwebsolutions.co
-
scottdunn.life
-
usdp.trade
-
pikmin.run
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3e19b57f827e4d5df5e09cd5cc115249.exe"C:\Users\Admin\AppData\Local\Temp\3e19b57f827e4d5df5e09cd5cc115249.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2312-133-0x0000000004BC0000-0x0000000004C53000-memory.dmp
memory/2312-132-0x0000000004D60000-0x0000000005080000-memory.dmp
memory/2312-129-0x0000000000AC0000-0x0000000000AD3000-memory.dmp
memory/2312-130-0x0000000003010000-0x000000000303F000-memory.dmp
memory/2360-116-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/2360-117-0x0000000002B71000-0x0000000002B85000-memory.dmp
memory/2360-115-0x0000000000750000-0x0000000000773000-memory.dmp
memory/2964-119-0x00000000008E0000-0x00000000008E1000-memory.dmp
memory/2964-125-0x0000000072480000-0x00000000724AF000-memory.dmp
memory/2964-126-0x00000000045F0000-0x0000000004604000-memory.dmp
memory/2964-122-0x00000000047D0000-0x0000000004AF0000-memory.dmp
memory/2964-123-0x00000000045B0000-0x00000000045C4000-memory.dmp
memory/2964-120-0x0000000072480000-0x00000000724AF000-memory.dmp
memory/3028-127-0x0000000002620000-0x0000000002711000-memory.dmp
memory/3028-124-0x0000000006280000-0x0000000006401000-memory.dmp
memory/3028-134-0x00000000027A0000-0x000000000288F000-memory.dmp