Analysis
- max time kernel
148s - max time network
136s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
15/08/2022, 07:51
General
- Target brazil order.scr
- Size 682KB
- Sample220815-jptrxaaha2
- SHA256 e8c2f0fc24e8cc88308a76edbd992b6be7e6036f728a22c5e8fffc1cc199a7c2
Malware Config
Extracted
-
formbook
-
4.1
-
p94a
-
wishgrove.com
-
parqueveiculos.com
-
spiderwebs.online
-
chulkanadham.com
-
cdtuan.net
-
zxazm.com
-
payment6528832.xyz
-
fengtaiol.com
-
bffsmovie.com
-
aliceseagerfitness.com
-
garisluruskonsulindo.website
-
analytical-gutter.net
-
ahcq8.com
-
fenyoga.com
-
ecleptic.cat
-
conjurecrafts.com
-
aquaway.date
-
apenpokkenschoonmaakbedrijf.com
-
zgramr.top
-
boweknives.site
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 5 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\brazil order.scr"C:\Users\Admin\AppData\Local\Temp\brazil order.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\brazil order.scr"C:\Users\Admin\AppData\Local\Temp\brazil order.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\brazil order.scr"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1376-69-0x0000000006B00000-0x0000000006C77000-memory.dmp
memory/1376-78-0x00000000063D0000-0x00000000064CC000-memory.dmp
memory/1376-76-0x00000000063D0000-0x00000000064CC000-memory.dmp
memory/1500-77-0x00000000000A0000-0x00000000000CF000-memory.dmp
memory/1500-75-0x0000000000670000-0x0000000000703000-memory.dmp
memory/1500-74-0x0000000000860000-0x0000000000B63000-memory.dmp
memory/1500-73-0x00000000000A0000-0x00000000000CF000-memory.dmp
memory/1500-72-0x0000000000090000-0x0000000000096000-memory.dmp
memory/1964-59-0x00000000042A0000-0x00000000042D4000-memory.dmp
memory/1964-54-0x0000000000230000-0x00000000002E2000-memory.dmp
memory/1964-58-0x0000000004DA0000-0x0000000004E1A000-memory.dmp
memory/1964-57-0x0000000000310000-0x000000000031C000-memory.dmp
memory/1964-56-0x0000000000360000-0x0000000000378000-memory.dmp
memory/1964-55-0x00000000759E1000-0x00000000759E3000-memory.dmp
memory/2044-67-0x0000000000A80000-0x0000000000D83000-memory.dmp
memory/2044-68-0x00000000000D0000-0x00000000000E4000-memory.dmp
memory/2044-66-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2044-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2044-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2044-60-0x0000000000400000-0x000000000042F000-memory.dmp