Analysis
- max time kernel
148s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
07/03/2022, 14:35
General
- Target svchost.exe
- Size 803KB
- Sample220307-rx15ysfdc5
- SHA256 a6525de47e9c194acea3d0048b4633a9bb0f0bab0bfe2eb5e1ec3aa126909e32
Malware Config
Extracted
-
formbook
-
4.1
-
w26e
-
alexispageart.com
-
69253.win
-
luckytimelondon.com
-
289788.icu
-
houserepairservice.com
-
z-i-z.com
-
onlinediyetsitem.com
-
birkinmetaverse.com
-
unual.com
-
doorbundle.com
-
unplugpropertymanagement.com
-
go-fastcargo.com
-
therestore.agency
-
rubyyyjones.com
-
bavtin.xyz
-
jktwatchweek.com
-
atendimento-app.cloud
-
inavi.xyz
-
topinsurancesecrets.com
-
webgplsolucoes.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2484-146-0x0000000007A30000-0x0000000007B51000-memory.dmp
memory/2484-141-0x0000000007FD0000-0x0000000008133000-memory.dmp
memory/3300-136-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3300-140-0x0000000001B70000-0x0000000001B85000-memory.dmp
memory/3300-139-0x000000000041F000-0x0000000000420000-memory.dmp
memory/3300-137-0x0000000001800000-0x0000000001B4A000-memory.dmp
memory/3344-134-0x0000000075060000-0x0000000075810000-memory.dmp
memory/3344-135-0x0000000005C80000-0x0000000005C8A000-memory.dmp
memory/3344-130-0x0000000000B20000-0x0000000000BF0000-memory.dmp
memory/3344-133-0x0000000005DE0000-0x0000000005E7C000-memory.dmp
memory/3344-132-0x0000000005CA0000-0x0000000005D32000-memory.dmp
memory/3344-131-0x00000000061B0000-0x0000000006754000-memory.dmp
memory/4948-143-0x00000000003B0000-0x00000000003DF000-memory.dmp
memory/4948-142-0x0000000000120000-0x0000000000127000-memory.dmp
memory/4948-144-0x0000000000C00000-0x0000000000F4A000-memory.dmp
memory/4948-145-0x0000000000F50000-0x0000000000FE4000-memory.dmp