Analysis
- max time kernel
4294183s - max time network
125s - platform
windows7_x64 - resource
win7-20220310-en - submitted
21/03/2022, 17:15
General
- Target Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe
- Size 51KB
- Sample220321-vsj8eshfar
- SHA256 909570efc48341a6ae00ae8dcbb8d751f912569a4756f7526bc7d0cf1cda81ed
Malware Config
Extracted
-
formbook
-
4.1
-
gaou
-
kreditkleansers.com
-
energyandoils.com
-
0wzr2dglc.com
-
coachadrisanchez.com
-
region10group.gmbh
-
shinraibuy.com
-
theleftycatcher.com
-
shop-hatchshowprint.xyz
-
mutoros.com
-
anicolon.com
-
tb19151.icu
-
vinyetgriera.online
-
hunterz-it.cloud
-
scareygood.com
-
newbalanceshopping.xyz
-
perfectgrsl.net
-
qffi.top
-
antoniocuomosindaco.com
-
evesbond.com
-
finelowdowntoskimtoday.info
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1824-54-0x0000000073F10000-0x00000000745FE000-memory.dmp
memory/1824-55-0x0000000000110000-0x0000000000124000-memory.dmp
memory/1824-56-0x0000000074CC1000-0x0000000074CC3000-memory.dmp
memory/1824-57-0x0000000004C40000-0x0000000004C41000-memory.dmp
memory/1824-58-0x00000000055E0000-0x0000000005676000-memory.dmp
memory/1824-59-0x0000000004BE0000-0x0000000004C30000-memory.dmp
memory/1824-60-0x0000000004C80000-0x0000000004CCE000-memory.dmp
memory/1824-61-0x00000000051A0000-0x00000000051EE000-memory.dmp
memory/1824-62-0x0000000005450000-0x000000000549C000-memory.dmp
memory/1972-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1972-65-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1972-67-0x0000000000400000-0x000000000042F000-memory.dmp