Analysis
- max time kernel
150s - max time network
152s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
- submitted
30/09/2022, 10:39
General
- Target فوری RFQ_AP65425652_032421,pdf.exe
- Size 474KB
- Sample220930-mpymmsecam
- SHA256 f89bda16cbe45d1a83fe2c107ae20b93f95f433c72b188cb76b8070073f25fc9
Malware Config
Extracted
-
formbook
-
nrln
-
IG7zJSm49UqTTuu/N/oTCIg=
-
CVLdAPgw0CRSMuZnRRU=
-
PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG
-
5i6p4GeQqtBgNRfGNQ==
-
5984keYswxh8mGZHz4ipAHtQ
-
VNJaK4Gh0CrOvHpW/p353A==
-
71rEtrL2icToyKGhcWrTxjsFU5T98zeO
-
r3q1sy1iZaL+2XIUAob7yw==
-
9+83Qkrk/vV/jVXsDvoTCIg=
-
aMFAgYF1prov8/UErH/Y1A==
-
Alqtx/0rxwEbCLdudftl
-
ImCbnglBSUHF0mv2tTSP40bPeYao
-
s4DFNvAJ4GIJ+g==
-
phOa6mtS8QQICuZnRRU=
-
7TSu5vqRtB45EZtf4WDSTBHPeYao
-
ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=
-
HF7jKjbGox2SAffTPw==
-
yAM3mOQot5l+cD0ikR5MGp8=
-
UYzW0/8z70JcQenVLidu1kLPeYao
-
OoCznp5UWz+hT9OBFXbfVhXPeYao
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\فوری RFQ_AP65425652_032421,pdf.exe"C:\Users\Admin\AppData\Local\Temp\فوری RFQ_AP65425652_032421,pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
sqlite3.dll
memory/592-76-0x0000000076BA1000-0x0000000076BA3000-memory.dmp
memory/592-70-0x0000000000970000-0x000000000097B000-memory.dmp
memory/592-75-0x0000000000090000-0x00000000000BD000-memory.dmp
memory/592-73-0x0000000000840000-0x00000000008CF000-memory.dmp
memory/592-72-0x0000000002050000-0x0000000002353000-memory.dmp
memory/592-71-0x0000000000090000-0x00000000000BD000-memory.dmp
memory/1424-77-0x0000000004240000-0x0000000004300000-memory.dmp
memory/1424-74-0x0000000004240000-0x0000000004300000-memory.dmp
memory/1424-68-0x0000000006A20000-0x0000000006B27000-memory.dmp
memory/1468-56-0x0000000000320000-0x0000000000328000-memory.dmp
memory/1468-55-0x0000000000300000-0x000000000030C000-memory.dmp
memory/1468-54-0x0000000000E00000-0x0000000000E74000-memory.dmp
memory/1776-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1776-67-0x00000000000F0000-0x0000000000100000-memory.dmp
memory/1776-66-0x0000000000950000-0x0000000000C53000-memory.dmp
memory/1776-65-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1776-64-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1776-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1776-58-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1776-57-0x0000000000400000-0x000000000042F000-memory.dmp