Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
18/02/2022, 11:48
General
- Target c35b8d27f7ed050e3bc31e536a0e389f.exe
- Size 822KB
- Sample220218-nyfnvscea2
- SHA256 c8dfddd4c5d6b2c5ee3c4f74651673e6975c4ae05d7aece0c08e40c2ad92db7e
Malware Config
Extracted
-
formbook
-
4.1
-
vy44
-
csdvehgry45y.com
-
letstayhome.com
-
davidfrechen.com
-
atticusandjules.com
-
meandbond.com
-
paar-fotoshooting.com
-
twboosterhq.com
-
shivamehandiarts.com
-
typhoonlogistics.net
-
vintagevowswedding.com
-
brittanymays.com
-
dreamylineart.com
-
vimspaces.com
-
thakurmosai.com
-
88-wealth.com
-
betsycousins.com
-
nationalcsno.online
-
mobileblockchainsolution.com
-
flymetothemundo.com
-
shopsuplementos.site
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Windows directory 6 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c35b8d27f7ed050e3bc31e536a0e389f.exe"C:\Users\Admin\AppData\Local\Temp\c35b8d27f7ed050e3bc31e536a0e389f.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1484-149-0x0000000000E60000-0x0000000000E8F000-memory.dmp
memory/1484-151-0x0000000002C10000-0x0000000002CA3000-memory.dmp
memory/1484-148-0x0000000000660000-0x0000000000674000-memory.dmp
memory/1484-150-0x0000000002DE0000-0x000000000312A000-memory.dmp
memory/1556-139-0x000001D57E240000-0x000001D57E244000-memory.dmp
memory/1556-137-0x000001D57DB20000-0x000001D57DB30000-memory.dmp
memory/1556-138-0x000001D57DB80000-0x000001D57DB90000-memory.dmp
memory/3028-152-0x0000000008A00000-0x0000000008B8B000-memory.dmp
memory/3028-144-0x00000000080B0000-0x00000000081FC000-memory.dmp
memory/3244-147-0x0000000000850000-0x0000000000864000-memory.dmp
memory/3244-145-0x00000000012B0000-0x00000000015FA000-memory.dmp
memory/3244-146-0x000000000041F000-0x0000000000420000-memory.dmp
memory/3244-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3244-143-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4056-135-0x0000000005A90000-0x0000000005A9A000-memory.dmp
memory/4056-140-0x000000000A3E0000-0x000000000A47C000-memory.dmp
memory/4056-136-0x0000000005CF0000-0x0000000005CF1000-memory.dmp
memory/4056-130-0x0000000000FC0000-0x0000000001096000-memory.dmp
memory/4056-134-0x000000007519E000-0x000000007519F000-memory.dmp
memory/4056-133-0x0000000005AF0000-0x0000000005B82000-memory.dmp
memory/4056-132-0x0000000006000000-0x00000000065A4000-memory.dmp
memory/4056-131-0x0000000005990000-0x00000000059B2000-memory.dmp