Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
21/03/2022, 17:15
General
- Target Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe
- Size 51KB
- Sample220321-vsj8eshfar
- SHA256 909570efc48341a6ae00ae8dcbb8d751f912569a4756f7526bc7d0cf1cda81ed
Malware Config
Extracted
-
formbook
-
4.1
-
gaou
-
kreditkleansers.com
-
energyandoils.com
-
0wzr2dglc.com
-
coachadrisanchez.com
-
region10group.gmbh
-
shinraibuy.com
-
theleftycatcher.com
-
shop-hatchshowprint.xyz
-
mutoros.com
-
anicolon.com
-
tb19151.icu
-
vinyetgriera.online
-
hunterz-it.cloud
-
scareygood.com
-
newbalanceshopping.xyz
-
perfectgrsl.net
-
qffi.top
-
antoniocuomosindaco.com
-
evesbond.com
-
finelowdowntoskimtoday.info
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1300-142-0x0000000001210000-0x0000000001224000-memory.dmp
memory/1300-133-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1300-135-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1300-136-0x0000000001290000-0x00000000015DA000-memory.dmp
memory/1300-137-0x000000000041F000-0x0000000000420000-memory.dmp
memory/1300-138-0x00000000011B0000-0x00000000011C4000-memory.dmp
memory/1300-141-0x000000000041F000-0x0000000000420000-memory.dmp
memory/1928-131-0x0000000075250000-0x0000000075A00000-memory.dmp
memory/1928-132-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/1928-130-0x0000000000A20000-0x0000000000A34000-memory.dmp
memory/3024-139-0x0000000008710000-0x0000000008854000-memory.dmp
memory/3024-143-0x0000000008DB0000-0x0000000008F15000-memory.dmp
memory/3024-148-0x00000000031D0000-0x0000000003288000-memory.dmp
memory/4888-144-0x00000000013D0000-0x00000000013EE000-memory.dmp
memory/4888-145-0x0000000001300000-0x000000000132F000-memory.dmp
memory/4888-146-0x0000000001EB0000-0x00000000021FA000-memory.dmp
memory/4888-147-0x0000000001B40000-0x0000000001BD3000-memory.dmp