Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
04/12/2023, 09:23
General
- Target PI and payment confirmed pdf.exe
- Size 1.1MB
- Sample231204-lcf2dsac3w
- SHA256 cd0dd222c7ba110e49ecd0aece6fa2915b5a126fed2fcdae12e114106688bee0
Malware Config
Extracted
-
formbook
-
4.1
-
n7ak
-
wise-transfer.info
-
jam-nins.com
-
thebestsocialcrm.com
-
majomeow222.com
-
ancientshadowguilt.space
-
gentleman-china.com
-
parquemermoz.store
-
taxuw.com
-
sharqiyapaints.com
-
libraryofkath.com
-
1949wan.com
-
synqr.net
-
bitchessgirls.com
-
btonu.cfd
-
coding-bootcamps-16314.com
-
leadership22-tdh.site
-
maximsboutique.com
-
irishsummertruffles.com
-
sdnaqianchuan.com
-
uyews.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Formbook payload 4 IoCs
- ModiLoader Second Stage 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI and payment confirmed pdf.exe"C:\Users\Admin\AppData\Local\Temp\PI and payment confirmed pdf.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
94Ologim.jpeg
94Ologrf.ini
94Ologrg.ini
94Ologri.ini
94Ologrv.ini
memory/3288-46-0x0000000008260000-0x0000000008379000-memory.dmp
memory/3288-41-0x0000000008260000-0x0000000008379000-memory.dmp
memory/3288-14-0x00000000080E0000-0x00000000081FB000-memory.dmp
memory/3288-40-0x0000000008260000-0x0000000008379000-memory.dmp
memory/3296-21-0x00000000006D0000-0x00000000006FF000-memory.dmp
memory/3296-15-0x0000000000A00000-0x0000000000A12000-memory.dmp
memory/3296-45-0x00000000024B0000-0x0000000002543000-memory.dmp
memory/3296-22-0x0000000002680000-0x00000000029CA000-memory.dmp
memory/3296-23-0x00000000006D0000-0x00000000006FF000-memory.dmp
memory/3296-18-0x0000000000A00000-0x0000000000A12000-memory.dmp
memory/3296-39-0x00000000024B0000-0x0000000002543000-memory.dmp
memory/3296-20-0x0000000000A00000-0x0000000000A12000-memory.dmp
memory/3528-0-0x00000000022B0000-0x00000000022B1000-memory.dmp
memory/3528-4-0x0000000000400000-0x0000000000517000-memory.dmp
memory/3528-2-0x0000000004190000-0x0000000005190000-memory.dmp
memory/3528-1-0x0000000004190000-0x0000000005190000-memory.dmp
memory/4240-13-0x0000000022180000-0x0000000022194000-memory.dmp
memory/4240-12-0x0000000002950000-0x0000000003950000-memory.dmp
memory/4240-10-0x0000000022240000-0x000000002258A000-memory.dmp
memory/4240-8-0x0000000002950000-0x0000000003950000-memory.dmp