Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
04/03/2022, 15:23
General
- Target lista naloga za kupovinu.exe
- Size 732KB
- Sample220304-ssf5nafbd8
- SHA256 42dfb1aeb19afac4595bc0146dd42ee251896ea1bf3ea8ab05d4bd28a7edbed1
Malware Config
Extracted
-
formbook
-
4.1
-
3nop
-
videohm.com
-
panache-rose.com
-
alnooncars-kw.com
-
trueblue2u.com
-
brussels-cafe.com
-
ip2c.net
-
influenzerr.com
-
rbcoq.com
-
zzful.com
-
drainthe.com
-
sumaholesson.com
-
cursosaprovados.com
-
genotecinc.com
-
dbrulhart.com
-
theapiarystudios.com
-
kensyu-kan.com
-
dkku88.com
-
tikhyper.com
-
aztecnort.com
-
homebrim.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lista naloga za kupovinu.exe"C:\Users\Admin\AppData\Local\Temp\lista naloga za kupovinu.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Webzvjpt.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\WebzvjpO.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet session5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session6⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/604-132-0x0000000000400000-0x00000000004BE000-memory.dmp
memory/604-134-0x0000000003E96000-0x0000000003E97000-memory.dmp
memory/604-131-0x00000000007C0000-0x00000000007C1000-memory.dmp
memory/1524-148-0x000000007249E000-0x000000007249F000-memory.dmp
memory/1524-138-0x0000000000610000-0x0000000000611000-memory.dmp
memory/1524-139-0x0000000072480000-0x00000000724AE000-memory.dmp
memory/1524-140-0x00000000026B0000-0x00000000029FA000-memory.dmp
memory/1524-149-0x00000000022F0000-0x0000000002304000-memory.dmp
memory/2084-160-0x0000000007440000-0x0000000007ABA000-memory.dmp
memory/2084-168-0x00000000070A0000-0x00000000070A8000-memory.dmp
memory/2084-146-0x0000000005470000-0x00000000054D6000-memory.dmp
memory/2084-147-0x00000000732B0000-0x0000000073A60000-memory.dmp
memory/2084-144-0x0000000004BF0000-0x0000000004C12000-memory.dmp
memory/2084-143-0x0000000004E40000-0x0000000005468000-memory.dmp
memory/2084-150-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/2084-145-0x0000000004D90000-0x0000000004DF6000-memory.dmp
memory/2084-152-0x00000000026B2000-0x00000000026B3000-memory.dmp
memory/2084-153-0x0000000005A90000-0x0000000005AAE000-memory.dmp
memory/2084-154-0x00000000026B5000-0x00000000026B7000-memory.dmp
memory/2084-165-0x0000000006FF0000-0x0000000007086000-memory.dmp
memory/2084-167-0x00000000070B0000-0x00000000070CA000-memory.dmp
memory/2084-157-0x0000000006C80000-0x0000000006CB2000-memory.dmp
memory/2084-159-0x0000000005FF0000-0x000000000600E000-memory.dmp
memory/2084-158-0x000000006FC80000-0x000000006FCCC000-memory.dmp
memory/2084-142-0x0000000002700000-0x0000000002736000-memory.dmp
memory/2084-161-0x0000000006CC0000-0x0000000006CDA000-memory.dmp
memory/2084-162-0x000000007FDF0000-0x000000007FDF1000-memory.dmp
memory/2084-166-0x0000000006FB0000-0x0000000006FBE000-memory.dmp
memory/2084-164-0x0000000006E00000-0x0000000006E0A000-memory.dmp
memory/2712-151-0x0000000007D30000-0x0000000007E95000-memory.dmp
memory/2712-170-0x0000000008AA0000-0x0000000008C07000-memory.dmp
memory/3440-163-0x00000000018D0000-0x0000000001C1A000-memory.dmp
memory/3440-155-0x0000000000700000-0x0000000000707000-memory.dmp
memory/3440-156-0x0000000000F80000-0x0000000000FAE000-memory.dmp
memory/3440-169-0x00000000016E0000-0x0000000001773000-memory.dmp