Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
28/09/2022, 10:59
General
- Target DOC2022092856789098765560890.exe
- Size 463KB
- Sample220928-m3d56affe6
- SHA256 5f3d522c2e8fb5fa25bee03bdd61f8b957935e4209849358d41f49c39fe82ddc
Malware Config
Extracted
-
formbook
-
c1no
-
SKHcqi+am5xGsHiCoXnH
-
BObxRpdRlNT5GCo3Eg8azNIQ
-
GPkN2SZ9gJOYqn4iaNIH6d1MRlk=
-
ZrdQ6Q4zd05LBFWPDc8=
-
KYQZEtvg85sq1t9jd7kazNIQ
-
KWu2/CZdnIFgf0p8
-
YlJ9mWmf+XkCjxzXSw==
-
nPeaENkZPzjWSh5DJiBVhlrTSx9V
-
GfUN8rKft59DsH2CoXnH
-
5ThnVCgjBm96jxzXSw==
-
pfb0D48Mk38v
-
uK6V0h16ziJXZuQ3NR8asKzT2Q==
-
QaxeYCJXoHFvKesgBSozIyC6bkTR8rbF
-
QT12wt/a0nsdrbY/oSGKqcq2wQ==
-
vfuiENwZZrvruTm5lHDF
-
iNsQyVnb3NHbtXyCoXnH
-
9jjn4jP8RyrjBYwNPvtfPg==
-
Wz1uwtUpdbrpwZXZq5HpXV7TSx9V
-
e9+RDvTx9HSZej/7PvtfPg==
-
oAeNwswNS6QgtnOdmcc=
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DOC2022092856789098765560890.exe"C:\Users\Admin\AppData\Local\Temp\DOC2022092856789098765560890.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2416-149-0x0000000008D50000-0x0000000008E8C000-memory.dmp
memory/2416-147-0x0000000008D50000-0x0000000008E8C000-memory.dmp
memory/2416-141-0x00000000032B0000-0x00000000033BF000-memory.dmp
memory/2796-132-0x0000000000880000-0x00000000008F6000-memory.dmp
memory/2828-137-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2828-138-0x0000000000401000-0x000000000042F000-memory.dmp
memory/2828-139-0x0000000001780000-0x0000000001ACA000-memory.dmp
memory/2828-140-0x0000000001160000-0x0000000001170000-memory.dmp
memory/2828-136-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2828-134-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4884-144-0x00000000010C0000-0x00000000010ED000-memory.dmp
memory/4884-143-0x0000000000770000-0x0000000000789000-memory.dmp
memory/4884-145-0x00000000030C0000-0x000000000340A000-memory.dmp
memory/4884-146-0x0000000002E60000-0x0000000002EEF000-memory.dmp
memory/4884-148-0x00000000010C0000-0x00000000010ED000-memory.dmp