Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
29/01/2024, 09:25
General
- Target MT103 SWIFT.exe
- Size 674KB
- Sample240129-ldmkkaeff4
- SHA256 ac0b1f47f36bdbc8974390d8473d74f6e71d5219a338796ed9d0582f8020f8c7
Malware Config
Extracted
-
formbook
-
4.1
-
ki21
-
nikonz9.com
-
piazzadelcondominio.cloud
-
stylistandcojewelry.com
-
watchingmovie79.store
-
dontpanic.solutions
-
cy888.xyz
-
pediatricdentalassoc.com
-
mg2selot7.us
-
gotireja.com
-
valdez.cloud
-
burgoontowing.top
-
void89.site
-
yoicok.online
-
rjinfo.xyz
-
omgwin7.online
-
pineislandhouseforsale.com
-
squidgamehalf.com
-
cpphgroup.com
-
kitahoki.pro
-
greenfieldnetworkinvest.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3328-14-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/3328-0-0x0000000000270000-0x000000000031E000-memory.dmp
memory/3328-2-0x0000000005290000-0x0000000005834000-memory.dmp
memory/3328-3-0x0000000004D80000-0x0000000004E12000-memory.dmp
memory/3328-4-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/3328-5-0x0000000004D20000-0x0000000004D2A000-memory.dmp
memory/3328-6-0x0000000005230000-0x000000000524C000-memory.dmp
memory/3328-7-0x0000000005260000-0x0000000005274000-memory.dmp
memory/3328-8-0x0000000006650000-0x00000000066C6000-memory.dmp
memory/3328-9-0x0000000008CC0000-0x0000000008D5C000-memory.dmp
memory/3328-10-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/3328-11-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/3328-1-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/3400-15-0x0000000001860000-0x0000000001BAA000-memory.dmp
memory/3400-18-0x00000000017E0000-0x00000000017F5000-memory.dmp
memory/3400-17-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3400-12-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3440-28-0x0000000008470000-0x0000000008559000-memory.dmp
memory/3440-19-0x0000000008470000-0x0000000008559000-memory.dmp
memory/3440-35-0x0000000008560000-0x0000000008643000-memory.dmp
memory/3440-32-0x0000000008560000-0x0000000008643000-memory.dmp
memory/3440-31-0x0000000008560000-0x0000000008643000-memory.dmp
memory/4840-23-0x0000000000520000-0x000000000054F000-memory.dmp
memory/4840-27-0x00000000025D0000-0x0000000002664000-memory.dmp
memory/4840-25-0x0000000000520000-0x000000000054F000-memory.dmp
memory/4840-24-0x0000000002830000-0x0000000002B7A000-memory.dmp
memory/4840-22-0x0000000000D10000-0x0000000000D2F000-memory.dmp
memory/4840-20-0x0000000000D10000-0x0000000000D2F000-memory.dmp