Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
21/06/2024, 01:23
General
- Target lhDCR5RvXwLbWQu.exe
- Size 903KB
- Sample240621-br5m7avbpf
- SHA256 780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5
Malware Config
Extracted
-
formbook
-
4.1
-
dy13
-
manga-house.com
-
kjsdhklssk51.xyz
-
b0ba138.xyz
-
bt365033.com
-
ccbsinc.net
-
mrwine.xyz
-
nrxkrd527o.xyz
-
hoshi.social
-
1912ai.com
-
serco2020.com
-
byfchfyr.xyz
-
imuschestvostorgov.online
-
austinheafey.com
-
mrdfa.club
-
883106.photos
-
profitablefxmarkets.com
-
taini00.net
-
brye.top
-
ginsm.com
-
sportglid.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Detects executables packed with SmartAssembly 1 IoCs
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\lhDCR5RvXwLbWQu.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2708-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2708-18-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2708-19-0x0000000001640000-0x0000000001655000-memory.dmp
memory/2708-16-0x00000000016B0000-0x00000000019FA000-memory.dmp
memory/3424-33-0x0000000008BE0000-0x0000000008CFC000-memory.dmp
memory/3424-30-0x0000000008BE0000-0x0000000008CFC000-memory.dmp
memory/3424-29-0x0000000008BE0000-0x0000000008CFC000-memory.dmp
memory/3424-26-0x0000000008A90000-0x0000000008BD2000-memory.dmp
memory/3424-20-0x0000000008A90000-0x0000000008BD2000-memory.dmp
memory/3500-24-0x0000000000570000-0x000000000059F000-memory.dmp
memory/3500-23-0x0000000000A50000-0x0000000000A6F000-memory.dmp
memory/3500-21-0x0000000000A50000-0x0000000000A6F000-memory.dmp
memory/4160-6-0x00000000747F0000-0x0000000074FA0000-memory.dmp
memory/4160-7-0x00000000060F0000-0x000000000661C000-memory.dmp
memory/4160-15-0x00000000747F0000-0x0000000074FA0000-memory.dmp
memory/4160-11-0x0000000008D80000-0x0000000008E04000-memory.dmp
memory/4160-10-0x0000000008D60000-0x0000000008D6C000-memory.dmp
memory/4160-9-0x0000000005600000-0x0000000005608000-memory.dmp
memory/4160-8-0x00000000055E0000-0x00000000055F2000-memory.dmp
memory/4160-12-0x0000000009260000-0x00000000092D6000-memory.dmp
memory/4160-0-0x00000000747FE000-0x00000000747FF000-memory.dmp
memory/4160-4-0x00000000052E0000-0x00000000052EA000-memory.dmp
memory/4160-5-0x0000000005440000-0x00000000054DC000-memory.dmp
memory/4160-3-0x0000000005140000-0x00000000051D2000-memory.dmp
memory/4160-2-0x0000000005610000-0x0000000005BB4000-memory.dmp
memory/4160-1-0x0000000000640000-0x0000000000728000-memory.dmp