Analysis
- max time kernel
176s - max time network
184s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
21/11/2022, 15:25
General
- Target file.exe
- Size 316KB
- Sample221121-stk51afd39
- SHA256 3a61280726d90b185f70884c4f7ff84af52be06f7fa2ceebf16065e8aee4feb6
Malware Config
Extracted
-
formbook
-
pgnt
-
0WG18LbM4lR9iqMRa4nlBzTb
-
jcfGYzPgZTqFZVO9FV2yIw==
-
laIfrdSC8/4CNg==
-
Q73ilev5GIWuOrAAFV2yIw==
-
Q2u/pMw7pv4sPA==
-
TbqvIUHwlQscPo0HFV2yIw==
-
8PNWfGPyE8n0IQ==
-
WtgROxXzvY2L
-
PryaRBNjm4eP
-
Y9Hdi06Cry1um9Sj68YAu1o=
-
3Gulyp7CMQtR78jvLkk=
-
JJ3GasTVTCRQT6Tfz6S6GlI=
-
RnS42bhb9tI0R6UpD6wOxriNxw==
-
he1mi2sOGfzTRGHnuA==
-
eaYjCtjxVjdU5XLRtBMBLKk9quA=
-
k9rTeEqYzzw8WaTfz6S6GlI=
-
5luVQwe2vJWKEAiMdF4=
-
MGW14L9OVk5Y5TaR6w/DqdhYxXVY
-
mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==
-
y5klhuMbE8n0IQ==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1112-149-0x00000000001D0000-0x00000000001FD000-memory.dmp
memory/1112-147-0x00000000020E0000-0x000000000216F000-memory.dmp
memory/1112-146-0x00000000022C0000-0x000000000260A000-memory.dmp
memory/1112-145-0x00000000001D0000-0x00000000001FD000-memory.dmp
memory/1112-144-0x0000000000590000-0x00000000005B7000-memory.dmp
memory/1276-137-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1276-141-0x00000000013F0000-0x0000000001400000-memory.dmp
memory/1276-140-0x0000000000422000-0x0000000000424000-memory.dmp
memory/1276-139-0x00000000019B0000-0x0000000001CFA000-memory.dmp
memory/1276-138-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1276-136-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1276-134-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2084-142-0x00000000024B0000-0x000000000265C000-memory.dmp
memory/2084-148-0x0000000007D00000-0x0000000007E3F000-memory.dmp
memory/2084-150-0x0000000007D00000-0x0000000007E3F000-memory.dmp
memory/4288-132-0x0000000000550000-0x00000000005A6000-memory.dmp