Analysis
- max time kernel
148s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:19
General
- Target PO202016.bat.exe
- Size 687KB
- Sample201109-2mzh2acvrx
- SHA256 e69790e910b1817bcfb714f20fda02b6e024babd3dfcea8fa982192928a5df93
Malware Config
Extracted
-
formbook
-
http://www.domaky.com/p2p/
-
helzbeeg.com
-
missfrugalfoodie.com
-
qqyzd.com
-
82d2.faith
-
1andonlyit.com
-
profeprest.com
-
kittiediggs.info
-
fotvw.info
-
waivedtestingsolutions.info
-
kumbetjeepsafari.com
-
almezi.com
-
killaqua.biz
-
bloemenbezorgenrotterdam.com
-
servogrill.com
-
wwwppjjppjj.com
-
sisolacoffee.com
-
bemovedfastsafe.cheap
-
indo-pacific-championship.com
-
cst8238040883870.com
-
lieflokken.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO202016.bat.exe"C:\Users\Admin\AppData\Local\Temp\PO202016.bat.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO202016.bat.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/912-0-0x0000000073800000-0x0000000073EEE000-memory.dmp
memory/912-1-0x0000000000560000-0x0000000000561000-memory.dmp
memory/912-3-0x0000000004F30000-0x0000000004FAB000-memory.dmp
memory/912-4-0x0000000004FB0000-0x000000000500C000-memory.dmp
memory/912-5-0x0000000005510000-0x0000000005511000-memory.dmp
memory/3816-7-0x00000000001F0000-0x00000000001FC000-memory.dmp
memory/3816-8-0x00000000001F0000-0x00000000001FC000-memory.dmp
memory/3816-10-0x00000000055F0000-0x0000000005774000-memory.dmp