Analysis
- max time kernel
146s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
06/06/2024, 15:19
General
- Target JDtnp2mcrQvXDeo.exe
- Size 652KB
- Sample240606-sp8eqsgg98
- SHA256 709cb8b2628d52b597a87f74bd8867dd40cb54bd48940d159dd11930d9d76472
Malware Config
Extracted
-
formbook
-
4.1
-
cr12
-
nff1291.com
-
satyainfra.com
-
hechiceradeamores.com
-
jfgminimalist.com
-
qut68q.com
-
pedandmore.com
-
sugardefender24-usa.us
-
somalse.com
-
lotusluxecandle.com
-
certificadobassetpro.com
-
veryaroma.com
-
thehistoryofindia.in
-
33155.cc
-
terastudy.net
-
84031.vip
-
heilsambegegnen.com
-
horizon-rg.info
-
junongpei.website
-
winstons.club
-
henslotalt.us
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2900-13-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/2900-0-0x000000007492E000-0x000000007492F000-memory.dmp
memory/2900-2-0x0000000005160000-0x0000000005704000-memory.dmp
memory/2900-3-0x0000000004C90000-0x0000000004D22000-memory.dmp
memory/2900-4-0x0000000004E50000-0x0000000004E5A000-memory.dmp
memory/2900-5-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/2900-10-0x00000000062E0000-0x000000000637C000-memory.dmp
memory/2900-8-0x0000000005140000-0x0000000005150000-memory.dmp
memory/2900-7-0x0000000005120000-0x000000000512E000-memory.dmp
memory/2900-9-0x0000000006020000-0x0000000006096000-memory.dmp
memory/2900-1-0x0000000000210000-0x00000000002B6000-memory.dmp
memory/2900-6-0x0000000005060000-0x0000000005076000-memory.dmp
memory/3532-18-0x0000000008B80000-0x0000000008C88000-memory.dmp
memory/3532-24-0x0000000008B80000-0x0000000008C88000-memory.dmp
memory/3532-27-0x0000000003100000-0x00000000031A9000-memory.dmp
memory/3532-28-0x0000000003100000-0x00000000031A9000-memory.dmp
memory/3532-31-0x0000000003100000-0x00000000031A9000-memory.dmp
memory/3624-21-0x00000000009E0000-0x0000000000A3A000-memory.dmp
memory/3624-19-0x00000000009E0000-0x0000000000A3A000-memory.dmp
memory/3624-22-0x0000000000350000-0x000000000037F000-memory.dmp
memory/4936-14-0x00000000013F0000-0x000000000173A000-memory.dmp
memory/4936-16-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4936-17-0x0000000001300000-0x0000000001314000-memory.dmp
memory/4936-11-0x0000000000400000-0x000000000042F000-memory.dmp