Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
05/06/2024, 15:14
General
- Target q5ApY1XJPFnBr0G.exe
- Size 710KB
- Sample240605-smp6daae7s
- SHA256 8b24936157cae59842c62804dd53988ac0e13a8ae3d1b7ba9500942a608fb451
Malware Config
Extracted
-
formbook
-
4.1
-
cr12
-
nff1291.com
-
satyainfra.com
-
hechiceradeamores.com
-
jfgminimalist.com
-
qut68q.com
-
pedandmore.com
-
sugardefender24-usa.us
-
somalse.com
-
lotusluxecandle.com
-
certificadobassetpro.com
-
veryaroma.com
-
thehistoryofindia.in
-
33155.cc
-
terastudy.net
-
84031.vip
-
heilsambegegnen.com
-
horizon-rg.info
-
junongpei.website
-
winstons.club
-
henslotalt.us
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\q5ApY1XJPFnBr0G.exe"C:\Users\Admin\AppData\Local\Temp\q5ApY1XJPFnBr0G.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\q5ApY1XJPFnBr0G.exe"C:\Users\Admin\AppData\Local\Temp\q5ApY1XJPFnBr0G.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\q5ApY1XJPFnBr0G.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1548-22-0x0000000001270000-0x000000000129F000-memory.dmp
memory/1548-21-0x0000000000130000-0x000000000013B000-memory.dmp
memory/1548-20-0x0000000000130000-0x000000000013B000-memory.dmp
memory/3368-19-0x0000000002B20000-0x0000000002C73000-memory.dmp
memory/3368-31-0x0000000008920000-0x0000000008A99000-memory.dmp
memory/3368-28-0x0000000008920000-0x0000000008A99000-memory.dmp
memory/3368-27-0x0000000008920000-0x0000000008A99000-memory.dmp
memory/3368-24-0x0000000002B20000-0x0000000002C73000-memory.dmp
memory/3864-12-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3864-15-0x00000000015A0000-0x00000000018EA000-memory.dmp
memory/3864-18-0x0000000001560000-0x0000000001574000-memory.dmp
memory/3864-17-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4508-8-0x0000000006060000-0x000000000606E000-memory.dmp
memory/4508-14-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/4508-0-0x0000000074A5E000-0x0000000074A5F000-memory.dmp
memory/4508-11-0x0000000009260000-0x00000000092FC000-memory.dmp
memory/4508-10-0x0000000006A70000-0x0000000006AE6000-memory.dmp
memory/4508-9-0x0000000006070000-0x0000000006080000-memory.dmp
memory/4508-7-0x0000000006010000-0x0000000006026000-memory.dmp
memory/4508-6-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/4508-5-0x0000000005520000-0x000000000552A000-memory.dmp
memory/4508-4-0x00000000055B0000-0x0000000005904000-memory.dmp
memory/4508-3-0x0000000005420000-0x00000000054B2000-memory.dmp
memory/4508-2-0x0000000005930000-0x0000000005ED4000-memory.dmp
memory/4508-1-0x0000000000A30000-0x0000000000AE6000-memory.dmp