Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/05/2024, 08:09
General
- Target OM0XJfFxoQJGoBl.exe
- Size 651KB
- Sample240513-j2kprsdf71
- SHA256 8b5376bda7dabd5355e17ed2d29a76b466f5197841a35568276c843e332835b4
Malware Config
Extracted
-
formbook
-
4.1
-
cn26
-
ajtsistemas.com
-
kolotylo.info
-
mraofficial.store
-
shopcupsareus.com
-
odishastatenews.in
-
yipicircle.life
-
bryve.shop
-
tempotrekstore.com
-
casinoslotsjoint.com
-
xiaoshuoxyz.com
-
art-birdsflyinghigh.com
-
odvip438.com
-
verlatservicios.com
-
bilocoin.world
-
lamaisonfacile.com
-
guojiang-v37.xyz
-
shsredgpoufnds.net
-
thequorumcompany.com
-
qf4h1tcpmgxor7b.skin
-
daisyjoanniezu.cyou
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OM0XJfFxoQJGoBl.exe"C:\Users\Admin\AppData\Local\Temp\OM0XJfFxoQJGoBl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OM0XJfFxoQJGoBl.exe"C:\Users\Admin\AppData\Local\Temp\OM0XJfFxoQJGoBl.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\OM0XJfFxoQJGoBl.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2316-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2316-17-0x00000000018F0000-0x0000000001904000-memory.dmp
memory/2316-16-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2316-14-0x00000000019E0000-0x0000000001D2A000-memory.dmp
memory/3480-30-0x0000000006E00000-0x0000000006ED5000-memory.dmp
memory/3480-27-0x0000000006E00000-0x0000000006ED5000-memory.dmp
memory/3480-26-0x0000000006E00000-0x0000000006ED5000-memory.dmp
memory/3480-23-0x0000000007A40000-0x0000000007BDE000-memory.dmp
memory/3480-18-0x0000000007A40000-0x0000000007BDE000-memory.dmp
memory/4468-13-0x0000000074A60000-0x0000000075210000-memory.dmp
memory/4468-4-0x0000000074A60000-0x0000000075210000-memory.dmp
memory/4468-9-0x0000000006BB0000-0x0000000006C26000-memory.dmp
memory/4468-0-0x0000000074A6E000-0x0000000074A6F000-memory.dmp
memory/4468-8-0x0000000006640000-0x0000000006656000-memory.dmp
memory/4468-7-0x0000000006600000-0x0000000006610000-memory.dmp
memory/4468-6-0x00000000065D0000-0x00000000065EE000-memory.dmp
memory/4468-10-0x0000000009230000-0x00000000092CC000-memory.dmp
memory/4468-1-0x00000000006D0000-0x0000000000776000-memory.dmp
memory/4468-2-0x0000000005710000-0x0000000005CB4000-memory.dmp
memory/4468-3-0x0000000005160000-0x00000000051F2000-memory.dmp
memory/4468-5-0x0000000005320000-0x000000000532A000-memory.dmp
memory/4924-21-0x00000000012E0000-0x000000000130F000-memory.dmp
memory/4924-20-0x0000000000AC0000-0x0000000000ACB000-memory.dmp
memory/4924-19-0x0000000000AC0000-0x0000000000ACB000-memory.dmp