Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
24/07/2023, 11:24
General
- Target z1Emir.exe
- Size 833KB
- Sample230724-nhpltsda7x
- SHA256 95c058c714f6b443f68eedc24f78b9b5b834b4e4d77dbc20666684bc6d2e321d
Malware Config
Extracted
-
formbook
-
4.1
-
p1a4
-
kingdiscoverkenya.com
-
bystander.news
-
soul2be.academy
-
rivistangelo.com
-
newproducthat.online
-
menstruationunlocked.com
-
acmepilot.site
-
onlinebuydogbeds.website
-
energysubstance.com
-
sltn188.com
-
speedoenperu.com
-
getkani.com
-
digitroncomputeracademy.com
-
homegrass.info
-
escrimax.com
-
3393t.vip
-
hhjjc.com
-
188judi.xyz
-
overhired.com
-
ingresaseeguro.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\z1Emir.exe"C:\Users\Admin\AppData\Local\Temp\z1Emir.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\z1Emir.exe"C:\Users\Admin\AppData\Local\Temp\z1Emir.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\z1Emir.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1544-157-0x0000000003290000-0x0000000003323000-memory.dmp
memory/1544-155-0x00000000010D0000-0x00000000010FF000-memory.dmp
memory/1544-153-0x0000000002F40000-0x000000000328A000-memory.dmp
memory/1544-152-0x00000000010D0000-0x00000000010FF000-memory.dmp
memory/1544-151-0x00000000006F0000-0x0000000000706000-memory.dmp
memory/1544-150-0x00000000006F0000-0x0000000000706000-memory.dmp
memory/3132-149-0x0000000008370000-0x00000000084A1000-memory.dmp
memory/3132-161-0x00000000084B0000-0x0000000008570000-memory.dmp
memory/3132-159-0x00000000084B0000-0x0000000008570000-memory.dmp
memory/3132-158-0x00000000084B0000-0x0000000008570000-memory.dmp
memory/3132-154-0x0000000008370000-0x00000000084A1000-memory.dmp
memory/3756-147-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3756-142-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3756-148-0x00000000012A0000-0x00000000012B4000-memory.dmp
memory/3756-145-0x0000000001300000-0x000000000164A000-memory.dmp
memory/4192-140-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/4192-144-0x0000000074D60000-0x0000000075510000-memory.dmp
memory/4192-141-0x000000000A370000-0x000000000A40C000-memory.dmp
memory/4192-133-0x0000000074D60000-0x0000000075510000-memory.dmp
memory/4192-139-0x0000000074D60000-0x0000000075510000-memory.dmp
memory/4192-138-0x0000000005060000-0x000000000506A000-memory.dmp
memory/4192-137-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/4192-136-0x0000000004FA0000-0x0000000005032000-memory.dmp
memory/4192-135-0x0000000005660000-0x0000000005C04000-memory.dmp
memory/4192-134-0x00000000004E0000-0x00000000005B6000-memory.dmp