Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
07/07/2023, 11:45
General
- Target REVISED SHIPMENT.exe
- Size 553KB
- Sample230707-nwp5hsgf27
- SHA256 44dd86acbfa3789aec858cc6e64db784622bc6c71e6c32909cfcbcacb743e60a
Malware Config
Extracted
-
formbook
-
4.1
-
s0g5
-
zj36ys.cfd
-
bense01.com
-
momentobeleza.com
-
bridge-polygon.net
-
pinyancollection.com
-
medvedevgave.com
-
hungrycatcol.com
-
gdasxo.xyz
-
vacanzainabruzzo.com
-
omtmmcio.cfd
-
extendkin.com
-
vlamuhendislik.com
-
hhor.info
-
tqzcqnuh.cfd
-
pinyancollection.com
-
3t8x1r.cfd
-
xkwi80.cfd
-
top-1234.com
-
3dy.shop
-
condo-roofs-r-us.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REVISED SHIPMENT.exe"C:\Users\Admin\AppData\Local\Temp\REVISED SHIPMENT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REVISED SHIPMENT.exe"C:\Users\Admin\AppData\Local\Temp\REVISED SHIPMENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REVISED SHIPMENT.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/332-133-0x0000000000760000-0x00000000007F0000-memory.dmp
memory/332-134-0x0000000005780000-0x0000000005D24000-memory.dmp
memory/332-135-0x00000000051D0000-0x0000000005262000-memory.dmp
memory/332-136-0x00000000051A0000-0x00000000051AA000-memory.dmp
memory/332-137-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/332-138-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/332-139-0x0000000008FC0000-0x000000000905C000-memory.dmp
memory/2176-151-0x0000000001190000-0x00000000014DA000-memory.dmp
memory/2176-154-0x0000000000F70000-0x0000000001004000-memory.dmp
memory/2176-152-0x0000000000780000-0x00000000007AF000-memory.dmp
memory/2176-150-0x0000000000780000-0x00000000007AF000-memory.dmp
memory/2176-149-0x0000000001170000-0x000000000118E000-memory.dmp
memory/2176-146-0x0000000001170000-0x000000000118E000-memory.dmp
memory/2596-147-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2596-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2596-144-0x00000000016E0000-0x00000000016F5000-memory.dmp
memory/2596-143-0x0000000001750000-0x0000000001A9A000-memory.dmp
memory/3100-145-0x00000000082C0000-0x0000000008394000-memory.dmp
memory/3100-155-0x0000000008A30000-0x0000000008BA3000-memory.dmp
memory/3100-156-0x0000000008A30000-0x0000000008BA3000-memory.dmp
memory/3100-158-0x0000000008A30000-0x0000000008BA3000-memory.dmp