Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
- submitted
04/08/2022, 14:50
General
- Target triage_dropped_file.exe
- Size 699KB
- Sample220804-r7kwqagae9
- SHA256 afa4507bce58af7b4050b41a86eabf424ac0e89a69b8a962c1dd58a1620457b5
Malware Config
Extracted
-
formbook
-
4.1
-
gu5d
-
blevvv.com
-
yoy01.com
-
balkhmarketing.agency
-
gangguanchina.net
-
0f0t6l.space
-
trump-news.com
-
hymanpullan.online
-
westsernschools.com
-
yourturdburglars.com
-
exitplanning101.com
-
vetsflyfree.xyz
-
sedist.net
-
bestkinopoisk.com
-
maccaverns.com
-
434960.com
-
mbyestudio.online
-
goldenagemininggroup.com
-
mintdomainz.xyz
-
www2823s.net
-
smartbeds-lt-2022.life
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2472-150-0x00000000012F0000-0x000000000131F000-memory.dmp
memory/2472-148-0x0000000001900000-0x0000000001994000-memory.dmp
memory/2472-147-0x00000000012F0000-0x000000000131F000-memory.dmp
memory/2472-146-0x0000000001A00000-0x0000000001D4A000-memory.dmp
memory/2472-145-0x0000000000420000-0x0000000000437000-memory.dmp
memory/2588-141-0x0000000003380000-0x000000000348F000-memory.dmp
memory/2588-149-0x0000000003490000-0x0000000003533000-memory.dmp
memory/2588-151-0x0000000003490000-0x0000000003533000-memory.dmp
memory/3688-140-0x00000000014B0000-0x00000000014C5000-memory.dmp
memory/3688-137-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3688-143-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3688-139-0x0000000001930000-0x0000000001C7A000-memory.dmp
memory/4576-135-0x000000000B270000-0x000000000B2D6000-memory.dmp
memory/4576-133-0x0000000005150000-0x000000000515A000-memory.dmp
memory/4576-132-0x00000000051D0000-0x0000000005262000-memory.dmp
memory/4576-134-0x000000000B040000-0x000000000B0DC000-memory.dmp
memory/4576-131-0x0000000005780000-0x0000000005D24000-memory.dmp
memory/4576-130-0x0000000000700000-0x00000000007B6000-memory.dmp