Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
16/10/2023, 07:50
General
- Target 6722fc544a3a7e67963eca47d376e278.exe
- Size 1.2MB
- Sample231016-jpac9sef66
- SHA256 be5a1d27153819f4c4eb1c96efb064deee2cf91d3cb7494377cc16adbe51e2e7
Malware Config
Extracted
-
formbook
-
4.1
-
n7ak
-
wise-transfer.info
-
jam-nins.com
-
thebestsocialcrm.com
-
majomeow222.com
-
ancientshadowguilt.space
-
gentleman-china.com
-
parquemermoz.store
-
taxuw.com
-
sharqiyapaints.com
-
libraryofkath.com
-
1949wan.com
-
synqr.net
-
bitchessgirls.com
-
btonu.cfd
-
coding-bootcamps-16314.com
-
leadership22-tdh.site
-
maximsboutique.com
-
irishsummertruffles.com
-
sdnaqianchuan.com
-
uyews.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Formbook payload 4 IoCs
- ModiLoader Second Stage 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6722fc544a3a7e67963eca47d376e278.exe"C:\Users\Admin\AppData\Local\Temp\6722fc544a3a7e67963eca47d376e278.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
94Ologim.jpeg
94Ologrf.ini
94Ologrg.ini
94Ologri.ini
94Ologrv.ini
memory/1000-5-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/1000-0-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/1000-4-0x0000000000400000-0x0000000000546000-memory.dmp
memory/1000-2-0x0000000002920000-0x0000000003920000-memory.dmp
memory/1000-1-0x0000000002920000-0x0000000003920000-memory.dmp
memory/2160-15-0x0000000000F10000-0x0000000000F27000-memory.dmp
memory/2160-17-0x0000000000F10000-0x0000000000F27000-memory.dmp
memory/2160-19-0x00000000004F0000-0x000000000051F000-memory.dmp
memory/2160-20-0x0000000000F30000-0x000000000127A000-memory.dmp
memory/2160-21-0x00000000004F0000-0x000000000051F000-memory.dmp
memory/2160-36-0x0000000000A10000-0x0000000000AA3000-memory.dmp
memory/2504-10-0x000000000FFB0000-0x00000000102FA000-memory.dmp
memory/2504-13-0x000000000FF50000-0x000000000FF64000-memory.dmp
memory/2504-12-0x00000000026A0000-0x00000000036A0000-memory.dmp
memory/2504-8-0x00000000026A0000-0x00000000036A0000-memory.dmp
memory/3160-39-0x0000000009110000-0x0000000009280000-memory.dmp
memory/3160-42-0x0000000009110000-0x0000000009280000-memory.dmp
memory/3160-38-0x0000000009110000-0x0000000009280000-memory.dmp
memory/3160-14-0x0000000008BD0000-0x0000000008D5C000-memory.dmp