Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
12/07/2023, 13:28
General
- Target QUOTE REQUEST #070011023.exe
- Size 591KB
- Sample230712-qqm43sdd44
- SHA256 ec07b80aca87a969c2f7c5c5a6ff490cb510c27dc68781e96facfafe9cbfb03a
Malware Config
Extracted
-
formbook
-
4.1
-
jy95
-
do-si-dough.com
-
cchapmanganato.com
-
04it.icu
-
kawebdesign.site
-
oasisconnects.com
-
op091.com
-
psychicstandupcomedy.com
-
harveylee.online
-
x55568.com
-
orbinlopez.one
-
45745931.buzz
-
undiereleaseco.com
-
cludybot.net
-
sailtmtbar.com
-
siennashih.com
-
premintxyz.net
-
xn--bj4bt9j.com
-
giornalaiditalia.com
-
colorfullemonade.com
-
baddiebearz.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTE REQUEST #070011023.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE REQUEST #070011023.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTE REQUEST #070011023.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE REQUEST #070011023.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QUOTE REQUEST #070011023.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3228-146-0x0000000008980000-0x0000000008B20000-memory.dmp
memory/3228-158-0x0000000008460000-0x0000000008508000-memory.dmp
memory/3228-156-0x0000000008460000-0x0000000008508000-memory.dmp
memory/3228-155-0x0000000008460000-0x0000000008508000-memory.dmp
memory/3420-134-0x0000000005A20000-0x0000000005FC4000-memory.dmp
memory/3420-135-0x0000000005510000-0x00000000055A2000-memory.dmp
memory/3420-136-0x00000000054D0000-0x00000000054DA000-memory.dmp
memory/3420-137-0x0000000005770000-0x0000000005780000-memory.dmp
memory/3420-138-0x0000000005770000-0x0000000005780000-memory.dmp
memory/3420-139-0x00000000092F0000-0x000000000938C000-memory.dmp
memory/3420-133-0x0000000000A70000-0x0000000000B0A000-memory.dmp
memory/4160-144-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4160-145-0x00000000015F0000-0x0000000001604000-memory.dmp
memory/4160-143-0x00000000016E0000-0x0000000001A2A000-memory.dmp
memory/4160-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4504-147-0x0000000000BE0000-0x0000000000BEE000-memory.dmp
memory/4504-149-0x0000000000BE0000-0x0000000000BEE000-memory.dmp
memory/4504-150-0x0000000000EF0000-0x0000000000F1F000-memory.dmp
memory/4504-151-0x0000000001900000-0x0000000001C4A000-memory.dmp
memory/4504-152-0x0000000000EF0000-0x0000000000F1F000-memory.dmp
memory/4504-154-0x0000000001800000-0x0000000001893000-memory.dmp