Analysis
- max time kernel
146s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:36
General
- Target Urgent Order.exe
- Size 571KB
- Sample201109-cbxc6rcbgn
- SHA256 2047ecb45a1bd7dad219077cd5446bffc34fdc7acad3d3293c576fc187b08996
Malware Config
Extracted
-
formbook
-
http://www.sandrxy.com/t8c/
-
kasra-shafieezadeh.com
-
geekhubworld.com
-
alevokotel.com
-
sayagantengok.com
-
mlearningapp.com
-
lseisraeltechtrip.com
-
goolge-img.com
-
lyjnys.com
-
choavealvlcidreyevfolk.win
-
buy-me-now.online
-
mercadologodelfuturo.com
-
hotelgreenvalleyjaipur.com
-
gujianworld.com
-
kitaherbal.com
-
bonemarrow.news
-
veronikagabrielova.com
-
xjwfgg.net
-
memoryid.info
-
aa9088.com
-
footballpredictionstomorrow.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Program Files directory 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Urgent Order.exe"C:\Users\Admin\AppData\Local\Temp\Urgent Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Urgent Order.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Urgent Order.exe"3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1020-21-0x00007FF6D4FF0000-0x00007FF6D5083000-memory.dmp
memory/1020-19-0x00007FF6D4FF0000-0x00007FF6D5083000-memory.dmp
memory/1020-20-0x00007FF6D4FF0000-0x00007FF6D5083000-memory.dmp
memory/1872-13-0x0000000000E60000-0x0000000000E79000-memory.dmp
memory/1872-17-0x00000000055B0000-0x000000000568E000-memory.dmp
memory/1872-14-0x0000000000E60000-0x0000000000E79000-memory.dmp
memory/3840-10-0x0000000000400000-0x000000000042D000-memory.dmp
memory/4640-0-0x0000000073E30000-0x000000007451E000-memory.dmp
memory/4640-9-0x0000000008190000-0x00000000081C4000-memory.dmp
memory/4640-8-0x0000000007610000-0x0000000007612000-memory.dmp
memory/4640-7-0x00000000078C0000-0x00000000078C1000-memory.dmp
memory/4640-6-0x0000000007600000-0x0000000007601000-memory.dmp
memory/4640-5-0x0000000007650000-0x0000000007651000-memory.dmp
memory/4640-4-0x0000000007AB0000-0x0000000007AB1000-memory.dmp
memory/4640-3-0x0000000005030000-0x00000000050B4000-memory.dmp
memory/4640-1-0x00000000007C0000-0x00000000007C1000-memory.dmp