Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
15/11/2022, 12:09
General
- Target ea54d53d78ae0254a2cd836034c4915a.exe
- Size 465KB
- Sample221115-pbfwsahf2v
- SHA256 8a013f0ce4ad8a801ef54f5fd3da7215783162d76eda63e515ad7a9de3e82a9f
Malware Config
Extracted
-
formbook
-
aoj8
-
ENTLx4lFGERVS9s=
-
rEA3IFQK5Dnyb8Xv
-
mBf53kjnt+/tHjbDz/bbMMQk0a4=
-
kmA7ItiWZ7qj2K8vMg==
-
bWbMk9SJaXV1Md5wtiua7i8uUQ==
-
cTWJZ5h7GYUB
-
B+OydinPo5vw40Sp+nI=
-
N9BHHJp7WJP/40Sp+nI=
-
RT6c8Dr65UHyb8Xv
-
vXmVd497GYUB
-
3WdLM65d/IWPtQ==
-
1Ip3U8N+Xndu2K8vMg==
-
LtW0iwe7j7Gh2gGL2+R7iw==
-
3LguLF0Hzx2ZVACf2+R7iw==
-
N6aWcrJkODQEENyu73A=
-
0FTVnBXGm77q/LP4
-
PRoECAfCotQx44gPY8whlggiTA==
-
ZtxTLtRpPjm67imhtxWm7i8uUQ==
-
NjAk6GES5xT2F0XH0+K6ccQk0a4=
-
sVvFX26P/IWPtQ==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 4 IoCs
- Program crash 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ea54d53d78ae0254a2cd836034c4915a.exe"C:\Users\Admin\AppData\Local\Temp\ea54d53d78ae0254a2cd836034c4915a.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4976 -s 10923⤵
- Program crash
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 188 -p 4976 -ip 49761⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2212-147-0x0000000001A40000-0x0000000001A50000-memory.dmp
memory/2212-150-0x0000000000401000-0x000000000042F000-memory.dmp
memory/2212-134-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2212-137-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2212-138-0x0000000000401000-0x000000000042F000-memory.dmp
memory/2212-149-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2212-141-0x00000000015F0000-0x000000000193A000-memory.dmp
memory/2212-142-0x0000000000422000-0x0000000000424000-memory.dmp
memory/2212-143-0x0000000001050000-0x0000000001060000-memory.dmp
memory/2212-146-0x0000000000422000-0x0000000000424000-memory.dmp
memory/2212-145-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2764-179-0x0000000007450000-0x0000000007460000-memory.dmp
memory/2764-185-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-148-0x0000000007B70000-0x0000000007C85000-memory.dmp
memory/2764-224-0x0000000007380000-0x0000000007390000-memory.dmp
memory/2764-223-0x0000000007380000-0x0000000007390000-memory.dmp
memory/2764-222-0x0000000007380000-0x0000000007390000-memory.dmp
memory/2764-221-0x0000000000980000-0x0000000000990000-memory.dmp
memory/2764-220-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-219-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-155-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-156-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-157-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-158-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-159-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-160-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-161-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-162-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-163-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-164-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-165-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-166-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-167-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-168-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-169-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-170-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-171-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-172-0x00000000024A0000-0x00000000024B0000-memory.dmp
memory/2764-173-0x0000000007450000-0x0000000007460000-memory.dmp
memory/2764-174-0x0000000007450000-0x0000000007460000-memory.dmp
memory/2764-218-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-176-0x00000000082F0000-0x0000000008468000-memory.dmp
memory/2764-217-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-178-0x0000000007450000-0x0000000007460000-memory.dmp
memory/2764-216-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-180-0x00000000082F0000-0x0000000008468000-memory.dmp
memory/2764-181-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-182-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-183-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-184-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-144-0x0000000002880000-0x00000000029FC000-memory.dmp
memory/2764-186-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-187-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-188-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-189-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-190-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-191-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-192-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-193-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-194-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-195-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-196-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-197-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-198-0x0000000007380000-0x0000000007390000-memory.dmp
memory/2764-199-0x0000000007380000-0x0000000007390000-memory.dmp
memory/2764-200-0x0000000007380000-0x0000000007390000-memory.dmp
memory/2764-201-0x0000000007380000-0x0000000007390000-memory.dmp
memory/2764-202-0x0000000007380000-0x0000000007390000-memory.dmp
memory/2764-203-0x0000000007380000-0x0000000007390000-memory.dmp
memory/2764-204-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-205-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-206-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-207-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-208-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-209-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-210-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-211-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-212-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-213-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-214-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2764-215-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/4312-177-0x00000000005C0000-0x00000000005ED000-memory.dmp
memory/4312-175-0x0000000000D20000-0x0000000000DAF000-memory.dmp
memory/4312-153-0x00000000005C0000-0x00000000005ED000-memory.dmp
memory/4312-154-0x0000000000FF0000-0x000000000133A000-memory.dmp
memory/4312-152-0x0000000000550000-0x00000000005AA000-memory.dmp
memory/4976-132-0x00000234B9490000-0x00000234B9508000-memory.dmp
memory/4976-133-0x00007FFD9D190000-0x00007FFD9DC51000-memory.dmp
memory/4976-140-0x00007FFD9D190000-0x00007FFD9DC51000-memory.dmp