Analysis
- max time kernel
149s - max time network
148s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
18/02/2022, 11:48
General
- Target c35b8d27f7ed050e3bc31e536a0e389f.exe
- Size 822KB
- Sample220218-nyfnvscea2
- SHA256 c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e
Malware Config
Extracted
-
formbook
-
4.1
-
vy44
-
csdvehgry45y.com
-
letstayhome.com
-
davidfrechen.com
-
atticusandjules.com
-
meandbond.com
-
paar-fotoshooting.com
-
twboosterhq.com
-
shivamehandiarts.com
-
typhoonlogistics.net
-
vintagevowswedding.com
-
brittanymays.com
-
dreamylineart.com
-
vimspaces.com
-
thakurmosai.com
-
88-wealth.com
-
betsycousins.com
-
nationalcsno.online
-
mobileblockchainsolution.com
-
flymetothemundo.com
-
shopsuplementos.site
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c35b8d27f7ed050e3bc31e536a0e389f.exe"C:\Users\Admin\AppData\Local\Temp\c35b8d27f7ed050e3bc31e536a0e389f.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/716-70-0x00000000000A0000-0x00000000000A9000-memory.dmp
memory/716-73-0x0000000001F10000-0x0000000001FA3000-memory.dmp
memory/716-72-0x0000000002040000-0x0000000002343000-memory.dmp
memory/716-71-0x00000000000B0000-0x00000000000DF000-memory.dmp
memory/912-68-0x0000000000140000-0x0000000000154000-memory.dmp
memory/912-66-0x0000000000A60000-0x0000000000D63000-memory.dmp
memory/912-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/912-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/912-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/912-65-0x0000000000400000-0x000000000042F000-memory.dmp
memory/912-67-0x000000000041F000-0x0000000000420000-memory.dmp
memory/1404-69-0x0000000006C20000-0x0000000006DC8000-memory.dmp
memory/1404-74-0x0000000006630000-0x000000000670C000-memory.dmp
memory/1572-60-0x0000000000C30000-0x0000000000C64000-memory.dmp
memory/1572-55-0x0000000073FAE000-0x0000000073FAF000-memory.dmp
memory/1572-59-0x0000000005840000-0x00000000058F4000-memory.dmp
memory/1572-58-0x0000000000540000-0x000000000054E000-memory.dmp
memory/1572-57-0x00000000048A0000-0x00000000048A1000-memory.dmp
memory/1572-56-0x0000000001320000-0x00000000013F6000-memory.dmp