Analysis
- max time kernel
119s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/04/2024, 11:36
General
- Target TS-240405-UF4.exe
- Size 564KB
- Sample240405-nql6nsbc55
- SHA256 ff992922faba92aaae30e5f2b9e4179209fe9242a90da90fe082f50e93138fc7
Malware Config
Extracted
-
formbook
-
4.1
-
be03
-
458q14v4ams2.com
-
priceoctopus.com
-
betinplay.xyz
-
bcnd.xyz
-
1510soliveavenue.com
-
mcdpropertypros.com
-
reddcrownexpress.com
-
rewardlabs.shop
-
burenbrand.com
-
revand.io
-
tractionendurancecoaching.com
-
jotaerreshopp.com
-
shopboyg.com
-
dakor.shop
-
groundswellmag.life
-
nehagadodia.com
-
dancarellibizbroker.com
-
meconline.co
-
ttmq.cc
-
thegoldenyouph.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TS-240405-UF4.exe"C:\Users\Admin\AppData\Local\Temp\TS-240405-UF4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TS-240405-UF4.exe"C:\Users\Admin\AppData\Local\Temp\TS-240405-UF4.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TS-240405-UF4.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1916-18-0x00000000006D0000-0x00000000006D7000-memory.dmp
memory/1916-24-0x00000000013D0000-0x0000000001463000-memory.dmp
memory/1916-22-0x0000000000A00000-0x0000000000A2F000-memory.dmp
memory/1916-21-0x0000000001080000-0x00000000013CA000-memory.dmp
memory/1916-20-0x0000000000A00000-0x0000000000A2F000-memory.dmp
memory/1916-19-0x00000000006D0000-0x00000000006D7000-memory.dmp
memory/2748-13-0x0000000001740000-0x0000000001A8A000-memory.dmp
memory/2748-10-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2748-15-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2748-16-0x00000000010F0000-0x0000000001104000-memory.dmp
memory/3528-17-0x00000000090A0000-0x000000000919A000-memory.dmp
memory/3528-32-0x0000000009420000-0x00000000095AC000-memory.dmp
memory/3528-29-0x0000000009420000-0x00000000095AC000-memory.dmp
memory/3528-28-0x0000000009420000-0x00000000095AC000-memory.dmp
memory/3528-25-0x00000000090A0000-0x000000000919A000-memory.dmp
memory/3708-12-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/3708-6-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/3708-5-0x0000000005370000-0x000000000537A000-memory.dmp
memory/3708-4-0x0000000005320000-0x0000000005330000-memory.dmp
memory/3708-3-0x0000000005390000-0x0000000005422000-memory.dmp
memory/3708-2-0x00000000058A0000-0x0000000005E44000-memory.dmp
memory/3708-1-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/3708-0-0x00000000008D0000-0x0000000000960000-memory.dmp
memory/3708-7-0x0000000005880000-0x000000000588C000-memory.dmp
memory/3708-9-0x000000000A2D0000-0x000000000A36C000-memory.dmp
memory/3708-8-0x0000000006810000-0x0000000006886000-memory.dmp