Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
09/05/2022, 10:54
General
- Target Bill of Lading.exe
- Size 622KB
- Sample220509-mzjlgafhap
- SHA256 f6acdf84ba27d835f11aaeaf29f71eab77a592fb6fea7a06d76bcd1d9228171c
Malware Config
Extracted
-
formbook
-
4.1
-
n4w3
-
fortune093.xyz
-
animuso.com
-
flylawfirm.com
-
healthya2ghee.com
-
catalyticconverterinsurance.com
-
rg6899rg6899.com
-
chezseneba.com
-
reason.center
-
bai315.com
-
e6pai.com
-
bollyholic.xyz
-
jobassistbd.com
-
k8yyds.com
-
ijinyuangamazon.com
-
mocalog.tech
-
buktibaru.com
-
cj1musicandsound.biz
-
liehutejingdui.top
-
izumi.fans
-
ykgbs.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bill of Lading.exe"C:\Users\Admin\AppData\Local\Temp\Bill of Lading.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bill of Lading.exe"C:\Users\Admin\AppData\Local\Temp\Bill of Lading.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Bill of Lading.exe"C:\Users\Admin\AppData\Local\Temp\Bill of Lading.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Bill of Lading.exe"C:\Users\Admin\AppData\Local\Temp\Bill of Lading.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Bill of Lading.exe"C:\Users\Admin\AppData\Local\Temp\Bill of Lading.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Bill of Lading.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1360-151-0x00000000031C0000-0x0000000003253000-memory.dmp
memory/1360-150-0x0000000003370000-0x00000000036BA000-memory.dmp
memory/1360-148-0x0000000000F70000-0x0000000000F9F000-memory.dmp
memory/1360-147-0x00000000007C0000-0x00000000007E7000-memory.dmp
memory/2408-145-0x0000000007780000-0x0000000007835000-memory.dmp
memory/2408-152-0x0000000007840000-0x00000000079BC000-memory.dmp
memory/2952-135-0x00000000093E0000-0x0000000009446000-memory.dmp
memory/2952-131-0x0000000005F10000-0x00000000064B4000-memory.dmp
memory/2952-132-0x0000000005960000-0x00000000059F2000-memory.dmp
memory/2952-133-0x0000000005910000-0x000000000591A000-memory.dmp
memory/2952-134-0x00000000090C0000-0x000000000915C000-memory.dmp
memory/2952-130-0x0000000000EB0000-0x0000000000F52000-memory.dmp
memory/4092-144-0x0000000001490000-0x00000000014A4000-memory.dmp
memory/4092-143-0x00000000014F0000-0x000000000183A000-memory.dmp
memory/4092-142-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4092-140-0x0000000000400000-0x000000000042F000-memory.dmp