Analysis
- max time kernel
148s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
10/01/2023, 12:49
General
- Target 6df873769694ef3980e2e19d8c657e4d993938b9c9ee8912a95f83027f1a2ea0.exe
- Size 731KB
- Sample230110-p2cbaaga78
- SHA256 6df873769694ef3980e2e19d8c657e4d993938b9c9ee8912a95f83027f1a2ea0
Malware Config
Extracted
-
formbook
-
4.1
-
a19i
-
onelovefungi.com
-
paperlesspoop.com
-
perfectsalaries.com
-
tutor-dashboard.com
-
canucksshine.com
-
brl-mo6.online
-
fathistudio.com
-
iptv-3.com
-
hbombmedia.com
-
ifizidi.com
-
dahuaguinee.com
-
jyrbz.com
-
aawwuk.com
-
aina.health
-
socialbod.com
-
27mk.top
-
gnomeswhognow.net
-
unrivaledpurpose.com
-
randy.cloud
-
referralcodesmarket.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6df873769694ef3980e2e19d8c657e4d993938b9c9ee8912a95f83027f1a2ea0.exe"C:\Users\Admin\AppData\Local\Temp\6df873769694ef3980e2e19d8c657e4d993938b9c9ee8912a95f83027f1a2ea0.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1980-132-0x00000000007F0000-0x00000000008AE000-memory.dmp
memory/1980-133-0x0000000005770000-0x0000000005D14000-memory.dmp
memory/1980-134-0x0000000005260000-0x00000000052F2000-memory.dmp
memory/1980-135-0x0000000005250000-0x000000000525A000-memory.dmp
memory/1980-136-0x0000000008C00000-0x0000000008C9C000-memory.dmp
memory/2096-143-0x0000000008250000-0x00000000083B1000-memory.dmp
memory/2096-157-0x0000000000A50000-0x0000000000A60000-memory.dmp
memory/2096-162-0x0000000000A50000-0x0000000000A60000-memory.dmp
memory/2096-164-0x0000000000A50000-0x0000000000A60000-memory.dmp
memory/2096-161-0x0000000000A40000-0x0000000000A50000-memory.dmp
memory/2096-154-0x0000000000A50000-0x0000000000A60000-memory.dmp
memory/2096-160-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/2096-153-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/2096-159-0x0000000000A50000-0x0000000000A60000-memory.dmp
memory/2096-158-0x0000000000A50000-0x0000000000A60000-memory.dmp
memory/2096-163-0x0000000000A50000-0x0000000000A60000-memory.dmp
memory/2096-156-0x0000000000A50000-0x0000000000A60000-memory.dmp
memory/2096-155-0x0000000000A50000-0x0000000000A60000-memory.dmp
memory/2096-151-0x00000000080C0000-0x00000000081CF000-memory.dmp
memory/2096-152-0x00000000080C0000-0x00000000081CF000-memory.dmp
memory/3252-141-0x00000000012D0000-0x000000000161A000-memory.dmp
memory/3252-142-0x0000000001220000-0x0000000001235000-memory.dmp
memory/3252-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3252-138-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4488-150-0x0000000000C70000-0x0000000000D04000-memory.dmp
memory/4488-149-0x0000000000700000-0x000000000072F000-memory.dmp
memory/4488-148-0x0000000000F20000-0x000000000126A000-memory.dmp
memory/4488-147-0x0000000000700000-0x000000000072F000-memory.dmp
memory/4488-146-0x00000000003A0000-0x00000000003B7000-memory.dmp