Analysis
- max time kernel
146s - max time network
135s - platform
windows7_x64 - resource
win7-20220414-en - submitted
07/06/2022, 09:23
General
- Target 042PRL1988.exe
- Size 712KB
- Sample220607-lch6radae2
- SHA256 201b2f41c62365df33280901cebbdefbd7bf70b35afe43d1a91f50e68c67e4d9
Malware Config
Extracted
-
formbook
-
4.1
-
h06r
-
zhiguanchang6.com
-
allgoodsmoke.com
-
tunescrybe.com
-
galabet591.com
-
booster210569.biz
-
artyswarehouse.com
-
nhm0w.com
-
omnetgroup.com
-
moyp10.xyz
-
login-redirect-instagram.com
-
cupmes.xyz
-
jdbowers.com
-
esacertificate.net
-
buckedupdrinks.com
-
survivorshealthsecrets.com
-
heyuan07.xyz
-
axecaliburs.com
-
anjimodernjudy.com
-
crozx.com
-
capitaltexts.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 5 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe"C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe"C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/604-77-0x0000000000070000-0x000000000009F000-memory.dmp
memory/604-75-0x0000000000640000-0x00000000006D4000-memory.dmp
memory/604-74-0x0000000002260000-0x0000000002563000-memory.dmp
memory/604-73-0x0000000000070000-0x000000000009F000-memory.dmp
memory/604-72-0x0000000000610000-0x0000000000632000-memory.dmp
memory/1280-69-0x0000000006A20000-0x0000000006BBA000-memory.dmp
memory/1280-78-0x0000000006D70000-0x0000000006EE5000-memory.dmp
memory/1280-76-0x0000000006D70000-0x0000000006EE5000-memory.dmp
memory/1600-59-0x0000000000D50000-0x0000000000D86000-memory.dmp
memory/1600-54-0x0000000000D90000-0x0000000000E48000-memory.dmp
memory/1600-58-0x0000000000640000-0x0000000000646000-memory.dmp
memory/1600-57-0x0000000005F50000-0x0000000005FE2000-memory.dmp
memory/1600-56-0x0000000000380000-0x0000000000392000-memory.dmp
memory/1600-55-0x0000000075CD1000-0x0000000075CD3000-memory.dmp
memory/2044-67-0x00000000008F0000-0x0000000000BF3000-memory.dmp
memory/2044-68-0x0000000000170000-0x0000000000185000-memory.dmp
memory/2044-66-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2044-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2044-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2044-60-0x0000000000400000-0x000000000042F000-memory.dmp