Analysis
- max time kernel
151s - max time network
42s - platform
windows7_x64 - resource
win7-20220715-en - resource tags
- submitted
01/08/2022, 06:22
General
- Target DHL_AWB_NO#907853880911.exe
- Size 673KB
- Sample220801-g4wtpseedl
- SHA256 8cfab7564a09852f6ac15b97c02e63ea07b6099f6d38d39c05b06c8e097e6d31
Malware Config
Extracted
-
formbook
-
4.1
-
s0s2
-
stripe-forecast.com
-
perfectingnextstage.com
-
primarole.com
-
nonnydesigns.com
-
wordsofweightandlevity.com
-
mafleursam.com
-
hardwarepicker.tech
-
minex-intl.com
-
thenextbigtech.net
-
rabeproject.com
-
sticktogracestudio.com
-
releve.space
-
readoku.net
-
carings.net
-
nasdaq-ex.store
-
au-techng.com
-
thethoughtgenius.com
-
how-to-learn-languages.net
-
kitabisabelanja.com
-
awndka.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 5 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL_AWB_NO#907853880911.exe"C:\Users\Admin\AppData\Local\Temp\DHL_AWB_NO#907853880911.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL_AWB_NO#907853880911.exe"C:\Users\Admin\AppData\Local\Temp\DHL_AWB_NO#907853880911.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL_AWB_NO#907853880911.exe"5⤵
- Deletes itself
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/472-80-0x0000000001E00000-0x0000000001E93000-memory.dmp
memory/472-79-0x0000000001EF0000-0x00000000021F3000-memory.dmp
memory/472-78-0x00000000000A0000-0x00000000000CF000-memory.dmp
memory/472-77-0x0000000000060000-0x000000000007F000-memory.dmp
memory/1256-69-0x0000000004E80000-0x0000000004FF7000-memory.dmp
memory/1256-81-0x0000000007C60000-0x0000000007DE6000-memory.dmp
memory/1256-72-0x0000000006720000-0x000000000687B000-memory.dmp
memory/1496-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1496-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1496-66-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1496-67-0x0000000000870000-0x0000000000B73000-memory.dmp
memory/1496-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1496-68-0x0000000000300000-0x0000000000314000-memory.dmp
memory/1496-71-0x0000000000350000-0x0000000000364000-memory.dmp
memory/1496-73-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1968-54-0x0000000000F60000-0x000000000100E000-memory.dmp
memory/1968-59-0x0000000000AA0000-0x0000000000AD6000-memory.dmp
memory/1968-58-0x0000000005070000-0x00000000050F4000-memory.dmp
memory/1968-57-0x0000000000470000-0x000000000047A000-memory.dmp
memory/1968-56-0x00000000002C0000-0x00000000002D6000-memory.dmp
memory/1968-55-0x00000000754D1000-0x00000000754D3000-memory.dmp