Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
- submitted
23/10/2023, 13:32
General
- Target PO8687.exe
- Size 761KB
- Sample231023-qs6dfaah49
- SHA256 1d18b8139377bf5246b24fd11e4386312cc4ab3e652ab9df534068ac96755394
Malware Config
Extracted
-
formbook
-
4.1
-
ro12
-
start399.com
-
decyfincoin.com
-
binguozhijiaok.com
-
one45.vip
-
55dy5s.top
-
regmt.pro
-
2ahxgaafifl.com
-
xn--6rtp2flvfc2h.com
-
justinmburns.com
-
los3.online
-
fleshaaikensdivinegiven7llc.com
-
servicedelv.services
-
apexcaryhomesforsale.com
-
shuraop.xyz
-
sagetotal.com
-
gratitude-et-compagnie.com
-
riderarea.com
-
digitalserviceact.online
-
contentbyc.com
-
agenda-digital-planner.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO8687.exe"C:\Users\Admin\AppData\Local\Temp\PO8687.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO8687.exe"C:\Users\Admin\AppData\Local\Temp\PO8687.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PO8687.exe"C:\Users\Admin\AppData\Local\Temp\PO8687.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO8687.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/380-16-0x0000000001A60000-0x0000000001DAA000-memory.dmp
memory/380-18-0x0000000000400000-0x000000000042F000-memory.dmp
memory/380-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/380-19-0x00000000016D0000-0x00000000016E4000-memory.dmp
memory/2404-22-0x00000000004C0000-0x00000000004CB000-memory.dmp
memory/2404-25-0x00000000008C0000-0x00000000008EF000-memory.dmp
memory/2404-24-0x0000000001170000-0x00000000014BA000-memory.dmp
memory/2404-23-0x00000000008C0000-0x00000000008EF000-memory.dmp
memory/2404-28-0x0000000000F80000-0x0000000001013000-memory.dmp
memory/2404-21-0x00000000004C0000-0x00000000004CB000-memory.dmp
memory/3136-26-0x0000000008D30000-0x0000000008EB5000-memory.dmp
memory/3136-20-0x0000000008D30000-0x0000000008EB5000-memory.dmp
memory/3136-29-0x000000000A5F0000-0x000000000A70B000-memory.dmp
memory/3136-30-0x000000000A5F0000-0x000000000A70B000-memory.dmp
memory/3136-32-0x000000000A5F0000-0x000000000A70B000-memory.dmp
memory/4868-7-0x00000000054B0000-0x00000000054BC000-memory.dmp
memory/4868-15-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/4868-12-0x000000000ED20000-0x000000000EDBC000-memory.dmp
memory/4868-11-0x000000000BC10000-0x000000000BC7E000-memory.dmp
memory/4868-10-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/4868-9-0x00000000055C0000-0x00000000055D0000-memory.dmp
memory/4868-8-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/4868-0-0x0000000000960000-0x0000000000A24000-memory.dmp
memory/4868-6-0x0000000005540000-0x000000000555C000-memory.dmp
memory/4868-5-0x00000000054C0000-0x00000000054CA000-memory.dmp
memory/4868-4-0x00000000055C0000-0x00000000055D0000-memory.dmp
memory/4868-3-0x0000000005400000-0x0000000005492000-memory.dmp
memory/4868-2-0x00000000058B0000-0x0000000005E54000-memory.dmp
memory/4868-1-0x00000000748C0000-0x0000000075070000-memory.dmp