Analysis
- max time kernel
152s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
31/03/2022, 00:23
General
- Target Reliable Supplies.exe
- Size 548KB
- Sample220331-apf2dabef5
- SHA256 dcc2581e7d573e4a33a8e8edfe740f7b74c54fdfe12531ef1c5a8e13abd89e87
Malware Config
Extracted
-
formbook
-
4.1
-
d1n3
-
scrubbinsisters.com
-
kawuldim.com
-
pyttoin.xyz
-
iyraproperties.com
-
miaurora.net
-
cricutonlinesales.store
-
huangsanguai.com
-
chayaelements.store
-
giftexpress15.xyz
-
antiwardrobe.com
-
wiggly.site
-
avrecommendwiki.com
-
galabet472.com
-
invtips.com
-
tvpoy.xyz
-
raidencity.net
-
ripper66.com
-
ipoyce.online
-
xn--h6q362bj4mp5c.com
-
rooplaza.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Blocklisted process makes network request 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2084-148-0x0000000002370000-0x0000000002403000-memory.dmp
memory/2084-146-0x0000000002470000-0x00000000027BA000-memory.dmp
memory/2084-145-0x0000000000160000-0x000000000018F000-memory.dmp
memory/2084-144-0x0000000000130000-0x0000000000157000-memory.dmp
memory/2712-142-0x0000000007C30000-0x0000000007DD1000-memory.dmp
memory/2712-149-0x0000000002AB0000-0x0000000002B68000-memory.dmp
memory/3304-134-0x0000000007A10000-0x0000000007AAC000-memory.dmp
memory/3304-135-0x0000000007DD0000-0x0000000007E36000-memory.dmp
memory/3304-130-0x0000000000820000-0x00000000008AE000-memory.dmp
memory/3304-133-0x0000000005160000-0x000000000516A000-memory.dmp
memory/3304-132-0x00000000051A0000-0x0000000005232000-memory.dmp
memory/3304-131-0x00000000056B0000-0x0000000005C54000-memory.dmp
memory/3760-140-0x0000000001940000-0x0000000001C8A000-memory.dmp
memory/3760-141-0x0000000001E40000-0x0000000001E54000-memory.dmp
memory/3760-138-0x0000000000400000-0x000000000042F000-memory.dmp