Resubmissions
21/02/2022, 13:18
220221-qj13csacf81021/02/2022, 12:26
220221-pl6j7abbgl421/02/2022, 11:41
220221-ntfs3aaac610Analysis
- max time kernel
148s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
21/02/2022, 11:41
General
- Target DOC022122.exe
- Size 773KB
- Sample220221-ntfs3aaac6
- SHA256 f80a58564f070acf295b2a76ce6331402b3e9e71eed07cf3e017376e1bdb0f36
Malware Config
Extracted
-
formbook
-
4.1
-
my11
-
groovereporter.com
-
thechurchofeveryone.com
-
pgonline111.online
-
blastingsoda.com
-
firsthandcares.com
-
choicenochoicegame.com
-
stephaniesantiago.com
-
guiadohomem.space
-
nk-tw.com
-
lhpcg.com
-
plenty.today
-
digirick.net
-
isuaco.online
-
305clorinda.com
-
itsmei.xyz
-
88y4.com
-
roduco.info
-
rachelzrileybeauty.com
-
evvlink-usa.com
-
photoboothique.art
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DOC022122.exe"C:\Users\Admin\AppData\Local\Temp\DOC022122.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2060-133-0x000001C590B20000-0x000001C590B30000-memory.dmp
memory/2060-134-0x000001C590D40000-0x000001C590D50000-memory.dmp
memory/2060-135-0x000001C593260000-0x000001C593264000-memory.dmp
memory/2400-130-0x0000000002370000-0x0000000002371000-memory.dmp
memory/2416-142-0x0000000007C20000-0x0000000007D96000-memory.dmp
memory/2416-148-0x0000000007DA0000-0x0000000007E47000-memory.dmp
memory/3564-143-0x0000000000110000-0x0000000000124000-memory.dmp
memory/3564-145-0x0000000002A50000-0x0000000002D9A000-memory.dmp
memory/3564-147-0x00000000028C0000-0x0000000002953000-memory.dmp
memory/3564-144-0x00000000009B0000-0x00000000009DF000-memory.dmp
memory/3880-141-0x0000000000C00000-0x0000000000C14000-memory.dmp
memory/3880-139-0x00000000028A0000-0x0000000002BEA000-memory.dmp
memory/3880-140-0x000000007249F000-0x00000000724A0000-memory.dmp
memory/3880-137-0x0000000072480000-0x00000000724AF000-memory.dmp
memory/3880-136-0x00000000008E0000-0x00000000008E1000-memory.dmp