Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
16/10/2023, 07:51
General
- Target 125255af5a734b869383667f65046574.exe
- Size 1.2MB
- Sample231016-jptf5scf3s
- SHA256 efc54c548203429207c8beaf887969123bdcfd1becadfe8008fae624d06d725e
Malware Config
Extracted
-
formbook
-
4.1
-
kmge
-
jia0752d.com
-
cq0jt.sbs
-
whimsicalweddingrentals.com
-
meetsex-here.life
-
hhe-crv220.com
-
bedbillionaire.com
-
soycmo.com
-
mrawkward.xyz
-
11ramshornroad.com
-
motoyonaturals.com
-
thischicloves.com
-
gacorbet.pro
-
ihsanid.com
-
pancaketurner.com
-
santanarstore.com
-
cr3dtv.com
-
negotools.com
-
landfillequip.com
-
sejasuapropriachefe.com
-
diamant-verkopen.store
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Formbook payload 4 IoCs
- ModiLoader Second Stage 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\125255af5a734b869383667f65046574.exe"C:\Users\Admin\AppData\Local\Temp\125255af5a734b869383667f65046574.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
LK3logim.jpeg
LK3logrf.ini
LK3logrg.ini
LK3logri.ini
LK3logrv.ini
memory/208-4-0x0000000000400000-0x0000000000546000-memory.dmp
memory/208-5-0x0000000002590000-0x0000000002591000-memory.dmp
memory/208-0-0x0000000002590000-0x0000000002591000-memory.dmp
memory/208-2-0x0000000002970000-0x0000000003970000-memory.dmp
memory/208-1-0x0000000002970000-0x0000000003970000-memory.dmp
memory/1164-12-0x0000000003470000-0x0000000004470000-memory.dmp
memory/1164-13-0x0000000010B80000-0x0000000010B94000-memory.dmp
memory/1164-10-0x0000000010C50000-0x0000000010F9A000-memory.dmp
memory/1164-8-0x0000000003470000-0x0000000004470000-memory.dmp
memory/1528-18-0x00000000008D0000-0x00000000008FF000-memory.dmp
memory/1528-36-0x00000000025F0000-0x0000000002683000-memory.dmp
memory/1528-20-0x00000000008D0000-0x00000000008FF000-memory.dmp
memory/1528-19-0x00000000028B0000-0x0000000002BFA000-memory.dmp
memory/1528-17-0x0000000000580000-0x00000000005A7000-memory.dmp
memory/1528-16-0x0000000000580000-0x00000000005A7000-memory.dmp
memory/3196-37-0x0000000009080000-0x0000000009116000-memory.dmp
memory/3196-38-0x0000000009080000-0x0000000009116000-memory.dmp
memory/3196-40-0x0000000009080000-0x0000000009116000-memory.dmp
memory/3196-14-0x0000000008410000-0x000000000855C000-memory.dmp