Analysis
- max time kernel
149s - max time network
18s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
- submitted
10/07/2024, 05:48
General
- Target G6uGAyUSVscVBYD.exe
- Size 746KB
- Sample240710-ghfwcssbpf
- SHA256 c17477a67b72e26224a8670e25ce6bb06e2653e3adbf3797649c137ab855dc24
Malware Config
Extracted
-
formbook
-
4.1
-
mc10
-
sttcorp.one
-
jack88.lat
-
owl-protect.com
-
hnszrrn.com
-
at89v2.com
-
h147.top
-
takle4creators.com
-
fondsa.xyz
-
mantenopolice.com
-
shophansler.com
-
dessertt.com
-
thecollisionmagazine.com
-
tatesfluffyfrenchies.com
-
h1f2v.rest
-
bluewandltd.com
-
cuplaho2003.shop
-
2thetcleaningservice.com
-
yc85w.top
-
natursache.shop
-
allmyabilities.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\G6uGAyUSVscVBYD.exe"C:\Users\Admin\AppData\Local\Temp\G6uGAyUSVscVBYD.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\G6uGAyUSVscVBYD.exe"C:\Users\Admin\AppData\Local\Temp\G6uGAyUSVscVBYD.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\G6uGAyUSVscVBYD.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/316-23-0x00000000000C0000-0x00000000000EF000-memory.dmp
memory/316-21-0x00000000002F0000-0x00000000002F8000-memory.dmp
memory/316-22-0x00000000002F0000-0x00000000002F8000-memory.dmp
memory/1280-19-0x0000000000010000-0x0000000000020000-memory.dmp
memory/1280-20-0x0000000004D80000-0x0000000004ED6000-memory.dmp
memory/2500-9-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2500-15-0x0000000000A80000-0x0000000000D83000-memory.dmp
memory/2500-7-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2500-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2500-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2500-17-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2500-18-0x0000000000170000-0x0000000000184000-memory.dmp
memory/2540-6-0x0000000004DF0000-0x0000000004E66000-memory.dmp
memory/2540-14-0x00000000747A0000-0x0000000074E8E000-memory.dmp
memory/2540-0-0x00000000747AE000-0x00000000747AF000-memory.dmp
memory/2540-5-0x0000000000520000-0x000000000052E000-memory.dmp
memory/2540-4-0x0000000000510000-0x0000000000518000-memory.dmp
memory/2540-3-0x0000000000380000-0x0000000000392000-memory.dmp
memory/2540-2-0x00000000747A0000-0x0000000074E8E000-memory.dmp
memory/2540-1-0x00000000009C0000-0x0000000000A7E000-memory.dmp