Analysis
- max time kernel
110s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
21/03/2022, 10:08
General
- Target 14ba954e55194b6aeaad53ed548500f2.exe
- Size 1000KB
- Sample220321-l58bcabbg4
- SHA256 9621e6459dc138fb11bc279b6583fc68eed0db7b284e198c74dda8385db8ce0d
Malware Config
Extracted
-
formbook
-
4.1
-
w26e
-
alexispageart.com
-
69253.win
-
luckytimelondon.com
-
289788.icu
-
houserepairservice.com
-
z-i-z.com
-
onlinediyetsitem.com
-
birkinmetaverse.com
-
unual.com
-
doorbundle.com
-
unplugpropertymanagement.com
-
go-fastcargo.com
-
therestore.agency
-
rubyyyjones.com
-
bavtin.xyz
-
jktwatchweek.com
-
atendimento-app.cloud
-
inavi.xyz
-
topinsurancesecrets.com
-
webgplsolucoes.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Modifies data under HKEY_USERS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14ba954e55194b6aeaad53ed548500f2.exe"C:\Users\Admin\AppData\Local\Temp\14ba954e55194b6aeaad53ed548500f2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\14ba954e55194b6aeaad53ed548500f2.exe"C:\Users\Admin\AppData\Local\Temp\14ba954e55194b6aeaad53ed548500f2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/460-144-0x0000000000400000-0x000000000042F000-memory.dmp
memory/460-145-0x00000000019F0000-0x0000000001D3A000-memory.dmp
memory/1500-134-0x0000000075360000-0x0000000075B10000-memory.dmp
memory/1500-135-0x0000000000240000-0x0000000000340000-memory.dmp
memory/1500-136-0x0000000005230000-0x00000000057D4000-memory.dmp
memory/1500-137-0x0000000004D20000-0x0000000004DB2000-memory.dmp
memory/1500-138-0x0000000004C80000-0x0000000005224000-memory.dmp
memory/1500-139-0x0000000004CF0000-0x0000000004CFA000-memory.dmp
memory/1500-143-0x0000000000D00000-0x0000000000D9C000-memory.dmp
memory/3332-140-0x000001671C790000-0x000001671C7A0000-memory.dmp
memory/3332-141-0x000001671D160000-0x000001671D170000-memory.dmp
memory/3332-142-0x000001671F710000-0x000001671F714000-memory.dmp