Analysis
- max time kernel
149s - max time network
138s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
13/09/2022, 06:26
General
- Target DHL Notification_pdf.exe
- Size 866KB
- Sample220913-g67c8aafer
- SHA256 dc0fe4b4b6bf019790cdf82fda499ae14961fafaedf137aa2325b30fe2f8cea5
Malware Config
Extracted
-
formbook
-
4.1
-
ko29
-
citusdig.site
-
ecomrise.store
-
aringtonortho.com
-
plan-indonesia.com
-
retreat-to-the-alps.com
-
themerchperch.biz
-
freshfashiondesign.com
-
zachmizrachi.com
-
machomancoin.site
-
racunhariini.com
-
13378888.com
-
landofnd.com
-
techactive.digital
-
yourdebttips.com
-
www147171.com
-
xraino.top
-
willshouseofhorrors.com
-
redfiree.com
-
cyanband.com
-
srbs35.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 6 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL Notification_pdf.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/944-80-0x00000000000C0000-0x00000000000EF000-memory.dmp
memory/944-78-0x0000000000E10000-0x0000000000EA3000-memory.dmp
memory/944-77-0x00000000000C0000-0x00000000000EF000-memory.dmp
memory/944-76-0x0000000000A60000-0x0000000000D63000-memory.dmp
memory/944-75-0x0000000000F50000-0x0000000000F76000-memory.dmp
memory/1416-68-0x0000000004B60000-0x0000000004CF5000-memory.dmp
memory/1416-71-0x0000000007260000-0x00000000073F3000-memory.dmp
memory/1416-81-0x0000000004DE0000-0x0000000004ED1000-memory.dmp
memory/1416-79-0x0000000004DE0000-0x0000000004ED1000-memory.dmp
memory/1488-58-0x0000000007F10000-0x0000000007F9E000-memory.dmp
memory/1488-59-0x0000000004210000-0x0000000004244000-memory.dmp
memory/1488-55-0x0000000076681000-0x0000000076683000-memory.dmp
memory/1488-56-0x0000000000510000-0x000000000052A000-memory.dmp
memory/1488-54-0x00000000001C0000-0x000000000029E000-memory.dmp
memory/1488-57-0x0000000000590000-0x000000000059C000-memory.dmp
memory/1524-67-0x0000000000180000-0x0000000000194000-memory.dmp
memory/1524-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1524-73-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1524-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1524-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1524-70-0x00000000002C0000-0x00000000002D4000-memory.dmp
memory/1524-66-0x00000000009D0000-0x0000000000CD3000-memory.dmp
memory/1524-69-0x0000000000400000-0x000000000042F000-memory.dmp