Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
25/08/2024, 01:14
General
- Target FyqYh8fPEic6dw9.exe
- Size 676KB
- Sample240825-blvk2a1hpp
- SHA256 c920a418d58520669f8f3d0db050c479bb16548283758221a24ad631e061fab7
Malware Config
Extracted
-
formbook
-
4.1
-
d16h
-
iki-graphy.online
-
l8z8c.vip
-
1709.asia
-
inematography-course-72246.bond
-
pis3noe2e.sbs
-
wernv.xyz
-
ovepepe.xyz
-
ama-online.world
-
ookmouse.fun
-
harkclothingdesigns.xyz
-
bbvvjuiqew.bond
-
sed-cars-93620.bond
-
esgateeganhe.shop
-
cekmeledak.info
-
ebulahorizon.buzz
-
peakers-92991.bond
-
essislotgoal16.top
-
hafi.biz
-
ichunyang.club
-
lrica.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FyqYh8fPEic6dw9.exe"C:\Users\Admin\AppData\Local\Temp\FyqYh8fPEic6dw9.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FyqYh8fPEic6dw9.exe"C:\Users\Admin\AppData\Local\Temp\FyqYh8fPEic6dw9.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\FyqYh8fPEic6dw9.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/628-18-0x0000000000400000-0x000000000042F000-memory.dmp
memory/628-19-0x00000000013F0000-0x0000000001404000-memory.dmp
memory/628-16-0x0000000001480000-0x00000000017CA000-memory.dmp
memory/1644-12-0x00000000080C0000-0x000000000815C000-memory.dmp
memory/1644-3-0x0000000004D80000-0x0000000004E12000-memory.dmp
memory/1644-6-0x00000000051E0000-0x00000000051FA000-memory.dmp
memory/1644-7-0x000000007516E000-0x000000007516F000-memory.dmp
memory/1644-8-0x0000000075160000-0x0000000075910000-memory.dmp
memory/1644-9-0x0000000004EC0000-0x0000000004ECC000-memory.dmp
memory/1644-10-0x00000000050C0000-0x00000000050D0000-memory.dmp
memory/1644-11-0x0000000005A00000-0x0000000005A76000-memory.dmp
memory/1644-0-0x000000007516E000-0x000000007516F000-memory.dmp
memory/1644-4-0x0000000075160000-0x0000000075910000-memory.dmp
memory/1644-15-0x0000000075160000-0x0000000075910000-memory.dmp
memory/1644-5-0x0000000004E40000-0x0000000004E4A000-memory.dmp
memory/1644-2-0x0000000005250000-0x00000000057F4000-memory.dmp
memory/1644-1-0x0000000000300000-0x00000000003AC000-memory.dmp
memory/3436-20-0x00000000081A0000-0x000000000833C000-memory.dmp
memory/3436-24-0x00000000081A0000-0x000000000833C000-memory.dmp
memory/3436-28-0x0000000008340000-0x000000000844D000-memory.dmp
memory/3436-29-0x0000000008340000-0x000000000844D000-memory.dmp
memory/3436-31-0x0000000008340000-0x000000000844D000-memory.dmp
memory/5020-21-0x0000000000E70000-0x0000000000E86000-memory.dmp
memory/5020-22-0x0000000000E70000-0x0000000000E86000-memory.dmp
memory/5020-23-0x0000000000950000-0x000000000097F000-memory.dmp