Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
06-03-2023 16:23
General
-
Target
APERTURA DEBANCOS.doc (323 KB).exe
-
Size
722KB
-
MD5
182bcaad3def25a94746b2d3208ad567
-
SHA1
c1e652d582e1cd146c8faac376e05a8d13f1d878
-
SHA256
54fde966426bdd3b101d43647e23f1ed4a527312982372af0cc6a5768fb386ed
-
SHA512
155f370f0f476d4b94cfd6254077337c46f49c976320a71cb3eaad1a9296cf55aed7620338fe7a547c80175fbb3e75459d8238337db040cc907c4a19b21f3db0
-
SSDEEP
12288:HoDzEcLL4ZjVUi0EosOijSmrXO9Ax3mIEDs0wvw1ajSxFrXhy:HG4s0jVLyijxZx2qI1ISxdXE
Malware Config
Extracted
formbook
4.1
kmge
jia0752d.com
cq0jt.sbs
whimsicalweddingrentals.com
meetsex-here.life
hhe-crv220.com
bedbillionaire.com
soycmo.com
mrawkward.xyz
11ramshornroad.com
motoyonaturals.com
thischicloves.com
gacorbet.pro
ihsanid.com
pancaketurner.com
santanarstore.com
cr3dtv.com
negotools.com
landfillequip.com
sejasuapropriachefe.com
diamant-verkopen.store
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload 3 IoCs
-
ModiLoader Second Stage 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\APERTURA DEBANCOS.doc (323 KB).exe"C:\Users\Admin\AppData\Local\Temp\APERTURA DEBANCOS.doc (323 KB).exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
1.6MB
-
Filesize
80KB
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
588KB