Analysis
- max time kernel
150s - max time network
10s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:19
General
- Target PO202016.bat.exe
- Size 687KB
- Sample201109-2mzh2acvrx
- SHA256 e69790e910b1817bcfb714f20fda02b6e024babd3dfcea8fa982192928a5df93
Malware Config
Extracted
-
formbook
-
http://www.domaky.com/p2p/
-
helzbeeg.com
-
missfrugalfoodie.com
-
qqyzd.com
-
82d2.faith
-
1andonlyit.com
-
profeprest.com
-
kittiediggs.info
-
fotvw.info
-
waivedtestingsolutions.info
-
kumbetjeepsafari.com
-
almezi.com
-
killaqua.biz
-
bloemenbezorgenrotterdam.com
-
servogrill.com
-
wwwppjjppjj.com
-
sisolacoffee.com
-
bemovedfastsafe.cheap
-
indo-pacific-championship.com
-
cst8238040883870.com
-
lieflokken.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Deletes itself 1 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO202016.bat.exe"C:\Users\Admin\AppData\Local\Temp\PO202016.bat.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO202016.bat.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/364-6-0x0000000000270000-0x0000000000292000-memory.dmp
memory/364-8-0x0000000003100000-0x0000000003260000-memory.dmp
memory/1992-0-0x0000000074BA0000-0x000000007528E000-memory.dmp
memory/1992-1-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/1992-3-0x0000000000B40000-0x0000000000BBB000-memory.dmp
memory/1992-4-0x0000000000CE0000-0x0000000000D3C000-memory.dmp