Analysis
- max time kernel
151s - max time network
11s - platform
windows7_x64 - resource
win7v20201028 - submitted
11/12/2020, 11:31
General
- Target ordine.exe
- Size 3.8MB
- Sample201211-qv3xntthrn
- SHA256 d69b7f8a3a50e7357a74fb671743c58b8db46f3f5cc6b191ba636eb33a161672
Malware Config
Extracted
-
formbook
-
http://www.registeredagentfirm.com/jqc/
-
strahlenschutz.digital
-
soterppe.com
-
wlw-hnlt.com
-
topheadlinetowitness-today.info
-
droriginals.com
-
baculatechie.online
-
definity.finance
-
weddingmustgoon.com
-
ludisenofloral.com
-
kenniscourtureconsignments.com
-
dl888.net
-
singledynamics.com
-
internetmarkaching.com
-
solidconstruct.site
-
ip-freight.com
-
11sxsx.com
-
incomecontent.com
-
the343radio.com
-
kimberlygoedhart.net
-
dgdoughnuts.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ordine.exe"C:\Users\Admin\AppData\Local\Temp\ordine.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/648-11-0x0000000000680000-0x0000000000698000-memory.dmp
memory/648-13-0x0000000001E10000-0x0000000001EE0000-memory.dmp
memory/1048-2-0x0000000073C60000-0x000000007434E000-memory.dmp
memory/1048-3-0x0000000000060000-0x0000000000061000-memory.dmp
memory/1048-5-0x00000000005A0000-0x00000000005B7000-memory.dmp
memory/1048-6-0x0000000000600000-0x000000000061F000-memory.dmp
memory/1048-7-0x00000000006C0000-0x00000000006CA000-memory.dmp
memory/1544-8-0x0000000000400000-0x000000000042E000-memory.dmp