Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
30/12/2024, 18:13
General
- Target 2.exe
- Size 431KB
- Sample241230-wtsrmavnat
- SHA256 7cf9a8e9f9164be0f93bfb8810892a0dbaf5f7748105a8375afa3cc558f9d940
Malware Config
Extracted
-
formbook
-
4.1
-
rzt
-
travelbykeystone.com
-
gardenstoresupply.com
-
tobelias.com
-
thecosmicdna.com
-
lmshawaii.com
-
icorn.finance
-
afontoto.com
-
usbracesbest.com
-
unity-title.com
-
kindredanimal.com
-
milestonecms.com
-
aljazeerahlounge.com
-
jokcreates.com
-
justjazzythings.com
-
tiktokbestdeals.com
-
ww-marketing.com
-
humblehousekeep.com
-
alloreklama.com
-
cranecurrency.info
-
maraisman.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
J3Llogim.jpeg
J3Llogrf.ini
J3Llogrg.ini
J3Llogri.ini
J3Llogrv.ini
memory/2008-8-0x0000000005420000-0x000000000542A000-memory.dmp
memory/2008-1-0x0000000000810000-0x0000000000882000-memory.dmp
memory/2008-0-0x000000007466E000-0x000000007466F000-memory.dmp
memory/2008-9-0x000000007466E000-0x000000007466F000-memory.dmp
memory/2008-10-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/2008-11-0x00000000063B0000-0x0000000006406000-memory.dmp
memory/2008-12-0x0000000006410000-0x0000000006446000-memory.dmp
memory/2008-6-0x0000000005450000-0x00000000054A6000-memory.dmp
memory/2008-15-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/2008-2-0x0000000005290000-0x000000000532C000-memory.dmp
memory/2008-3-0x00000000058E0000-0x0000000005E84000-memory.dmp
memory/2008-4-0x0000000005330000-0x00000000053C2000-memory.dmp
memory/2008-5-0x0000000005270000-0x000000000527A000-memory.dmp
memory/2008-7-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/2320-22-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2320-23-0x0000000001830000-0x0000000001844000-memory.dmp
memory/2320-18-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2320-19-0x00000000015B0000-0x00000000015C4000-memory.dmp
memory/2320-16-0x00000000018D0000-0x0000000001C1A000-memory.dmp
memory/2320-13-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3232-26-0x00000000001F0000-0x0000000000206000-memory.dmp
memory/3232-25-0x00000000001F0000-0x0000000000206000-memory.dmp
memory/3504-24-0x0000000003330000-0x000000000340B000-memory.dmp
memory/3504-41-0x0000000003330000-0x000000000340B000-memory.dmp
memory/3504-46-0x0000000007E70000-0x0000000007F32000-memory.dmp
memory/3504-48-0x0000000007E70000-0x0000000007F32000-memory.dmp
memory/3504-20-0x0000000002F20000-0x0000000003021000-memory.dmp