Analysis
- max time kernel
146s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
22/05/2024, 08:00
General
- Target Цитата.exe
- Size 562KB
- Sample240522-jv38jagh89
- SHA256 151bfa7336a9c96e65bf8a0eeb54a3d34665e612c8c5b3a7886f16a6f58277c4
Malware Config
Extracted
-
formbook
-
4.1
-
gy14
-
mavbam.com
-
theanhedonia.com
-
budgetnurseries.com
-
buflitr.com
-
alqamarhotel.com
-
2660348.top
-
123bu6.shop
-
v72999.com
-
yzyz841.xyz
-
247fracing.com
-
naples.beauty
-
twinklethrive.com
-
loscaseros.com
-
creditspisatylegko.site
-
sgyy3ej2dgwesb5.com
-
ufocafe.net
-
techn9nehollywoodundead.com
-
truedatalab.com
-
alterdpxlmarketing.com
-
harborspringsfire.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Adds policy Run key to start application 2 TTPs 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Цитата.exe"C:\Users\Admin\AppData\Local\Temp\Цитата.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
Z3Nlogim.jpeg
Z3Nlogrf.ini
Z3Nlogrg.ini
Z3Nlogri.ini
Z3Nlogrv.ini
memory/1132-7-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1132-8-0x00000000017D0000-0x0000000001B1A000-memory.dmp
memory/1132-10-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1132-11-0x0000000001310000-0x0000000001325000-memory.dmp
memory/3500-47-0x000000000A450000-0x000000000A5DE000-memory.dmp
memory/3500-12-0x00000000087E0000-0x000000000898B000-memory.dmp
memory/3500-39-0x000000000A450000-0x000000000A5DE000-memory.dmp
memory/3500-38-0x000000000A450000-0x000000000A5DE000-memory.dmp
memory/3500-33-0x00000000087E0000-0x000000000898B000-memory.dmp
memory/4344-6-0x000002047B4C0000-0x000002047B546000-memory.dmp
memory/4344-13-0x00007FFEE9B40000-0x00007FFEEA601000-memory.dmp
memory/4344-1-0x00007FFEE9B43000-0x00007FFEE9B45000-memory.dmp
memory/4344-5-0x0000020479340000-0x0000020479346000-memory.dmp
memory/4344-4-0x00007FFEE9B40000-0x00007FFEEA601000-memory.dmp
memory/4344-3-0x0000020479380000-0x000002047939E000-memory.dmp
memory/4344-2-0x0000020479410000-0x0000020479486000-memory.dmp
memory/4344-0-0x0000020478FA0000-0x0000020478FAC000-memory.dmp
memory/4948-17-0x0000000000C40000-0x0000000000C6F000-memory.dmp
memory/4948-16-0x0000000000FF0000-0x0000000000FFE000-memory.dmp
memory/4948-14-0x0000000000FF0000-0x0000000000FFE000-memory.dmp