Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
09/06/2024, 01:16
General
- Target JDtnp2mcrQvXDeo.exe
- Size 652KB
- Sample240609-bmvmesbd3w
- SHA256 709cb8b2628d52b597a87f74bd8867dd40cb54bd48940d159dd11930d9d76472
Malware Config
Extracted
-
formbook
-
4.1
-
cr12
-
nff1291.com
-
satyainfra.com
-
hechiceradeamores.com
-
jfgminimalist.com
-
qut68q.com
-
pedandmore.com
-
sugardefender24-usa.us
-
somalse.com
-
lotusluxecandle.com
-
certificadobassetpro.com
-
veryaroma.com
-
thehistoryofindia.in
-
33155.cc
-
terastudy.net
-
84031.vip
-
heilsambegegnen.com
-
horizon-rg.info
-
junongpei.website
-
winstons.club
-
henslotalt.us
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 59 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\JDtnp2mcrQvXDeo.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1208-14-0x0000000001A10000-0x0000000001D5A000-memory.dmp
memory/1208-17-0x00000000018F0000-0x0000000001904000-memory.dmp
memory/1208-16-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1208-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1880-21-0x0000000000FA0000-0x0000000000FCF000-memory.dmp
memory/1880-20-0x0000000000CE0000-0x0000000000CEB000-memory.dmp
memory/1880-19-0x0000000000CE0000-0x0000000000CEB000-memory.dmp
memory/3456-30-0x0000000008AA0000-0x0000000008BD5000-memory.dmp
memory/3456-27-0x0000000008AA0000-0x0000000008BD5000-memory.dmp
memory/3456-26-0x0000000008AA0000-0x0000000008BD5000-memory.dmp
memory/3456-23-0x0000000007730000-0x000000000781E000-memory.dmp
memory/3456-18-0x0000000007730000-0x000000000781E000-memory.dmp
memory/4100-6-0x00000000053A0000-0x00000000053B6000-memory.dmp
memory/4100-13-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4100-10-0x000000000A1C0000-0x000000000A25C000-memory.dmp
memory/4100-9-0x0000000006270000-0x00000000062E6000-memory.dmp
memory/4100-7-0x00000000053E0000-0x00000000053EE000-memory.dmp
memory/4100-8-0x0000000006240000-0x0000000006250000-memory.dmp
memory/4100-0-0x00000000752EE000-0x00000000752EF000-memory.dmp
memory/4100-5-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4100-4-0x0000000004F70000-0x0000000004F7A000-memory.dmp
memory/4100-3-0x0000000004FE0000-0x0000000005072000-memory.dmp
memory/4100-2-0x0000000005590000-0x0000000005B34000-memory.dmp
memory/4100-1-0x00000000004D0000-0x0000000000576000-memory.dmp