Analysis
- max time kernel
154s - max time network
146s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
17/02/2022, 18:24
General
- Target 1fd18d12f95ae72da27cab03c5136f86.exe
- Size 764KB
- Sample220217-w129msebbj
- SHA256 a6fc3d54528af98d4e971543db7f11f891d08269e288ad6822959c0a47665609
Malware Config
Extracted
-
formbook
-
4.1
-
p0t9
-
marketplacewins.com
-
boymeetsmilf.com
-
ruhuplus.com
-
adultescortnft.com
-
app683.icu
-
viade.store
-
businesscardadvertiser.com
-
5649tk.com
-
daoguo456.com
-
digitalservice.pro
-
muabannothienuy.com
-
geneseeampwyoming.com
-
olliejay00.com
-
pristineintegrity.info
-
jimdeyux0kopgnhsldig.club
-
eadsscale.club
-
iwelim.space
-
s29x.club
-
brysonhajee.com
-
trainership.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1fd18d12f95ae72da27cab03c5136f86.exe"C:\Users\Admin\AppData\Local\Temp\1fd18d12f95ae72da27cab03c5136f86.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/472-70-0x000000000041F000-0x0000000000420000-memory.dmp
memory/472-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/472-71-0x00000000004A0000-0x00000000004B4000-memory.dmp
memory/472-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/472-65-0x0000000000770000-0x0000000000A73000-memory.dmp
memory/472-64-0x0000000000400000-0x000000000042F000-memory.dmp
memory/472-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/472-67-0x00000000001A0000-0x00000000001B4000-memory.dmp
memory/472-66-0x000000000041F000-0x0000000000420000-memory.dmp
memory/1248-68-0x00000000073D0000-0x0000000007565000-memory.dmp
memory/1248-78-0x0000000008230000-0x00000000083A7000-memory.dmp
memory/1248-72-0x00000000076D0000-0x0000000007852000-memory.dmp
memory/1672-54-0x000000007435E000-0x000000007435F000-memory.dmp
memory/1672-57-0x0000000000390000-0x000000000039E000-memory.dmp
memory/1672-59-0x0000000001F30000-0x0000000001F64000-memory.dmp
memory/1672-56-0x0000000004C40000-0x0000000004C41000-memory.dmp
memory/1672-58-0x0000000005500000-0x00000000055B4000-memory.dmp
memory/1672-55-0x00000000002A0000-0x0000000000366000-memory.dmp
memory/1800-74-0x0000000000BF0000-0x0000000000CF4000-memory.dmp
memory/1800-73-0x0000000075341000-0x0000000075343000-memory.dmp
memory/1800-75-0x00000000000C0000-0x00000000000EF000-memory.dmp
memory/1800-76-0x0000000002100000-0x0000000002403000-memory.dmp
memory/1800-77-0x0000000000A60000-0x0000000000AF3000-memory.dmp