Analysis
- max time kernel
119s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
08/04/2022, 09:38
General
- Target 87869f39271a39790c4be28e50cf8ce5.exe
- Size 776KB
- Sample220408-ll2pfsbfb7
- SHA256 c0760105fed05b99698c3f1e5bb6ed6e2e9b386315d0e187cd075b8ed5ea7fe5
Malware Config
Extracted
-
formbook
-
4.1
-
ce20
-
tiendacbdsevilla.com
-
cambodianairlines.net
-
xtypelife.online
-
8568008.com
-
truelanguageacademy.com
-
fibverse.com
-
thhhh.xyz
-
maskschool.com
-
missbrazilsc.com
-
suonas.com
-
esteel24.com
-
dreamoffkartal.com
-
errebasics.com
-
novaworldmarinacity.com
-
sailingt.com
-
8ylady.com
-
d5lb1.club
-
mexicovegetal.com
-
ahfsaleleaseback.com
-
sjcad11.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies data under HKEY_USERS 6 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\87869f39271a39790c4be28e50cf8ce5.exe"C:\Users\Admin\AppData\Local\Temp\87869f39271a39790c4be28e50cf8ce5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\87869f39271a39790c4be28e50cf8ce5.exe"C:\Users\Admin\AppData\Local\Temp\87869f39271a39790c4be28e50cf8ce5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2376-134-0x0000000000700000-0x00000000007CC000-memory.dmp
memory/2376-135-0x0000000005750000-0x0000000005CF4000-memory.dmp
memory/2376-136-0x00000000051A0000-0x0000000005232000-memory.dmp
memory/2376-137-0x00000000052E0000-0x000000000537C000-memory.dmp
memory/2376-138-0x0000000005170000-0x000000000517A000-memory.dmp
memory/2376-139-0x0000000000D30000-0x0000000000D96000-memory.dmp
memory/4592-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4592-142-0x0000000001370000-0x00000000016BA000-memory.dmp