Analysis
- max time kernel
149s - max time network
146s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 19:32
General
- Target Order.exe
- Size 674KB
- Sample201109-gjeev3ctf6
- SHA256 c5b06fbd603308f84e5f80396dc5de515ec75a43825732c8a53265add22942c8
Malware Config
Extracted
-
formbook
-
http://www.mansiobok.info/mm20/
-
sarretichilifarm.com
-
saveinnature.com
-
myavatarstore.com
-
foreignlanguageservices.com
-
casinobonusesonline.net
-
hvajmi.online
-
convertvt.online
-
nokwispaa.com
-
carbuckbuilder.com
-
deorianews.online
-
motorcyclestudy.com
-
simplereview.info
-
laotiantou.ltd
-
lh-machine.com
-
513manbet.com
-
grosirkurmamurah.com
-
howup.net
-
2bct.com
-
fiberartspace.com
-
virtual-ba.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/268-12-0x000007FEF7590000-0x000007FEF780A000-memory.dmp
memory/532-0-0x00000000003F0000-0x0000000000499000-memory.dmp
memory/1260-5-0x0000000004BD0000-0x0000000004CCE000-memory.dmp
memory/1760-2-0x0000000000300000-0x0000000000314000-memory.dmp
memory/1760-4-0x00000000031B0000-0x000000000327E000-memory.dmp
memory/1760-6-0x0000000075460000-0x000000007546C000-memory.dmp
memory/1760-7-0x0000000075AC0000-0x0000000075BDD000-memory.dmp