Analysis
- max time kernel
91s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/05/2022, 17:50
General
- Target SecuriteInfo.com.Trojan.MSIL.Formbook.NUM.MTB.2339.exe
- Size 1.5MB
- Sample220520-wekgpsbbe3
- SHA256 1ee02de26540eaa184f366e18366bda9ab636c9ce1918ff17eab10d9455c1a6c
Score
10/10
Malware Config
Signatures
- Arkei
Arkei is an infostealer written in C++.
- Downloads MZ/PE file
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Formbook.NUM.MTB.2339.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Formbook.NUM.MTB.2339.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Formbook.NUM.MTB.2339.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Formbook.NUM.MTB.2339.exe"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 13523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4288 -ip 42881⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
sqlite3.dll
memory/1052-131-0x00000000050B0000-0x0000000005654000-memory.dmp
memory/1052-132-0x0000000004BF0000-0x0000000004C8C000-memory.dmp
memory/1052-133-0x0000000008180000-0x0000000008212000-memory.dmp
memory/1052-134-0x0000000005770000-0x000000000577A000-memory.dmp
memory/1052-135-0x0000000010EA0000-0x0000000010EC2000-memory.dmp
memory/1052-130-0x0000000000150000-0x000000000024E000-memory.dmp
memory/4288-140-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4288-139-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4288-137-0x0000000000400000-0x000000000041C000-memory.dmp