Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
23/03/2022, 12:07
General
- Target inquiry.scr
- Size 996KB
- Sample220323-pacgzadfb5
- SHA256 710cf8f0a914a5baf6d61323ec2f33babc05c1374f4ae3fa8a2b04099c8f1b7f
Malware Config
Extracted
-
formbook
-
4.1
-
s16r
-
kellieroysellsnc.com
-
valleylowvoltage.com
-
mltuo900.xyz
-
visitingpuntacana.com
-
weiwushi.com
-
austintechjob.com
-
rxstarcbd.com
-
shopstudioesi.com
-
filetto-server.xyz
-
relianceltdbnk.com
-
unethical.world
-
yedd.store
-
esthershhs.com
-
magaddis.com
-
scenicdrivetours.com
-
123gest.com
-
2020mortagelifeinsurance.com
-
faceinle.com
-
integritymarking.com
-
alfatoto.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inquiry.scr"C:\Users\Admin\AppData\Local\Temp\inquiry.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inquiry.scr"C:\Users\Admin\AppData\Local\Temp\inquiry.scr"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\inquiry.scr"C:\Users\Admin\AppData\Local\Temp\inquiry.scr"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\inquiry.scr"C:\Users\Admin\AppData\Local\Temp\inquiry.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\inquiry.scr"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/228-152-0x0000000002530000-0x00000000025C3000-memory.dmp
memory/228-151-0x0000000002790000-0x0000000002ADA000-memory.dmp
memory/228-149-0x0000000000660000-0x000000000068F000-memory.dmp
memory/228-148-0x0000000000C60000-0x0000000000C76000-memory.dmp
memory/1488-131-0x0000000005CD0000-0x0000000006274000-memory.dmp
memory/1488-132-0x00000000055E0000-0x0000000005672000-memory.dmp
memory/1488-133-0x0000000005680000-0x000000000568A000-memory.dmp
memory/1488-134-0x00000000091F0000-0x000000000928C000-memory.dmp
memory/1488-130-0x0000000000B30000-0x0000000000C2E000-memory.dmp
memory/2688-146-0x00000000085C0000-0x000000000876E000-memory.dmp
memory/2688-153-0x0000000008A70000-0x0000000008BC3000-memory.dmp
memory/2688-143-0x00000000084A0000-0x00000000085B3000-memory.dmp
memory/2804-142-0x0000000001360000-0x0000000001374000-memory.dmp
memory/2804-145-0x00000000013D0000-0x00000000013E4000-memory.dmp
memory/2804-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2804-141-0x0000000001460000-0x00000000017AA000-memory.dmp
memory/2804-138-0x0000000000400000-0x000000000042F000-memory.dmp