Resubmissions
21/02/2022, 13:18
220221-qj13csacf81021/02/2022, 12:26
220221-pl6j7abbgl421/02/2022, 11:41
220221-ntfs3aaac610Analysis
- max time kernel
146s - max time network
146s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
21/02/2022, 11:41
General
- Target DOC022122.exe
- Size 773KB
- Sample220221-ntfs3aaac6
- SHA256 f80a58564f070acf295b2a76ce6331402b3e9e71eed07cf3e017376e1bdb0f36
Malware Config
Extracted
-
formbook
-
4.1
-
my11
-
groovereporter.com
-
thechurchofeveryone.com
-
pgonline111.online
-
blastingsoda.com
-
firsthandcares.com
-
choicenochoicegame.com
-
stephaniesantiago.com
-
guiadohomem.space
-
nk-tw.com
-
lhpcg.com
-
plenty.today
-
digirick.net
-
isuaco.online
-
305clorinda.com
-
itsmei.xyz
-
88y4.com
-
roduco.info
-
rachelzrileybeauty.com
-
evvlink-usa.com
-
photoboothique.art
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DOC022122.exe"C:\Users\Admin\AppData\Local\Temp\DOC022122.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/436-67-0x0000000000200000-0x0000000000214000-memory.dmp
memory/436-62-0x0000000000090000-0x0000000000091000-memory.dmp
memory/436-66-0x000000007249F000-0x00000000724A0000-memory.dmp
memory/436-65-0x0000000002090000-0x0000000002393000-memory.dmp
memory/436-58-0x0000000072480000-0x00000000724AF000-memory.dmp
memory/436-63-0x0000000072480000-0x00000000724AF000-memory.dmp
memory/436-59-0x0000000000080000-0x0000000000081000-memory.dmp
memory/812-54-0x0000000075F21000-0x0000000075F23000-memory.dmp
memory/812-55-0x0000000000230000-0x0000000000231000-memory.dmp
memory/1332-71-0x00000000000C0000-0x00000000000EF000-memory.dmp
memory/1332-73-0x0000000001CD0000-0x0000000001D63000-memory.dmp
memory/1332-72-0x0000000001FA0000-0x00000000022A3000-memory.dmp
memory/1332-70-0x0000000000730000-0x000000000073A000-memory.dmp
memory/1436-74-0x0000000007EE0000-0x000000000803D000-memory.dmp
memory/1436-68-0x0000000006C90000-0x0000000006E16000-memory.dmp