Analysis
- max time kernel
150s - max time network
132s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:55
General
- Target DHL293413110038.exe
- Size 384KB
- Sample201109-ryngqf4stj
- SHA256 bae14f53a8553b739d9eae5d0f751e608e7f33f3d7fecf92f345bc806bf676d5
Malware Config
Extracted
-
formbook
-
http://www.stilonf.com/hb7/
-
foanascuba.com
-
dy-fruits.com
-
cibatek.com
-
feattracker.com
-
destinycentreafrica.com
-
treeswaterpeople.com
-
luxtravelagency.com
-
szynfoerlugmees.win
-
townhouse.company
-
sher.ltd
-
magicplacement.com
-
makeyourdadsafe.com
-
y299199.com
-
telealerte.biz
-
lemonsquizy.com
-
techtelope.info
-
16georgestreetgeelongwest.com
-
starlifenews.com
-
xn--ok0bq0p63cw08a.com
-
quickstopsite.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL293413110038.exe"C:\Users\Admin\AppData\Local\Temp\DHL293413110038.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL293413110038.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1028-0-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/1028-1-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/1028-3-0x0000000005270000-0x00000000052B2000-memory.dmp
memory/1028-4-0x00000000052C0000-0x00000000052F1000-memory.dmp
memory/1028-5-0x0000000005800000-0x0000000005801000-memory.dmp
memory/1628-7-0x00000000011B0000-0x00000000011B6000-memory.dmp
memory/1628-8-0x00000000011B0000-0x00000000011B6000-memory.dmp
memory/1628-10-0x00000000054B0000-0x000000000559B000-memory.dmp