Analysis
- max time kernel
146s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
28/05/2024, 01:27
General
- Target Цитата.exe
- Size 562KB
- Sample240528-bt9d6aaf95
- SHA256 151bfa7336a9c96e65bf8a0eeb54a3d34665e612c8c5b3a7886f16a6f58277c4
Malware Config
Extracted
-
formbook
-
4.1
-
gy14
-
mavbam.com
-
theanhedonia.com
-
budgetnurseries.com
-
buflitr.com
-
alqamarhotel.com
-
2660348.top
-
123bu6.shop
-
v72999.com
-
yzyz841.xyz
-
247fracing.com
-
naples.beauty
-
twinklethrive.com
-
loscaseros.com
-
creditspisatylegko.site
-
sgyy3ej2dgwesb5.com
-
ufocafe.net
-
techn9nehollywoodundead.com
-
truedatalab.com
-
alterdpxlmarketing.com
-
harborspringsfire.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Detects executables packed with or use KoiVM 1 IoCs
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Цитата.exe"C:\Users\Admin\AppData\Local\Temp\Цитата.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"3⤵
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1988-16-0x0000000000760000-0x000000000078F000-memory.dmp
memory/1988-15-0x0000000000340000-0x0000000000367000-memory.dmp
memory/1988-14-0x0000000000340000-0x0000000000367000-memory.dmp
memory/3528-24-0x00000000092E0000-0x00000000093E2000-memory.dmp
memory/3528-21-0x00000000092E0000-0x00000000093E2000-memory.dmp
memory/3528-19-0x00000000092E0000-0x00000000093E2000-memory.dmp
memory/3528-12-0x0000000008E30000-0x0000000008F47000-memory.dmp
memory/4416-10-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4416-7-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4416-8-0x0000000000DF0000-0x000000000113A000-memory.dmp
memory/4416-11-0x00000000012A0000-0x00000000012B5000-memory.dmp
memory/4828-4-0x00000251CB3C0000-0x00000251CB3DE000-memory.dmp
memory/4828-13-0x00007FFA85650000-0x00007FFA86111000-memory.dmp
memory/4828-6-0x00000251E5630000-0x00000251E56B6000-memory.dmp
memory/4828-5-0x00000251CB3A0000-0x00000251CB3A6000-memory.dmp
memory/4828-0-0x00000251CB000000-0x00000251CB00C000-memory.dmp
memory/4828-3-0x00007FFA85650000-0x00007FFA86111000-memory.dmp
memory/4828-2-0x00000251CB510000-0x00000251CB586000-memory.dmp
memory/4828-1-0x00007FFA85653000-0x00007FFA85655000-memory.dmp