Analysis
- max time kernel
147s - max time network
134s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/12/2020, 08:44
General
- Target POgMmI.exe
- Size 1.3MB
- Sample201217-nynryghnwe
- SHA256 4f11e57e682eba91e574e673edce45efab46c20ad2d98826fb1b0880adee2aa0
Malware Config
Extracted
-
formbook
-
http://www.bestylishstore.com/wsu/
-
anticoronapreventionshop.com
-
zabaera.com
-
13shares.com
-
doudoutrip.com
-
fabdivanails.com
-
4525wichita.com
-
victoriabroadcast.com
-
syfxzs.com
-
cqyzhs.com
-
yesamper.com
-
nnqglqwl.com
-
dontbringithome.com
-
fakekiwi.com
-
sellmyhousecashnyc.com
-
wordshirts.store
-
geezerbible.com
-
admibd.com
-
acid-gaming.net
-
originalproductsbotanica.com
-
frenchracing.club
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\POgMmI.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/820-16-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3840-22-0x0000000005E70000-0x0000000005FBF000-memory.dmp
memory/3840-20-0x0000000000120000-0x000000000012A000-memory.dmp
memory/3840-19-0x0000000000120000-0x000000000012A000-memory.dmp
memory/3968-7-0x0000000005560000-0x0000000005561000-memory.dmp
memory/3968-11-0x0000000006170000-0x000000000621D000-memory.dmp
memory/3968-12-0x0000000006150000-0x0000000006158000-memory.dmp
memory/3968-14-0x0000000006320000-0x00000000063AF000-memory.dmp
memory/3968-15-0x0000000006480000-0x0000000006481000-memory.dmp
memory/3968-10-0x0000000005470000-0x0000000005482000-memory.dmp
memory/3968-9-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/3968-8-0x0000000005450000-0x0000000005451000-memory.dmp
memory/3968-2-0x00000000738E0000-0x0000000073FCE000-memory.dmp
memory/3968-6-0x0000000005A60000-0x0000000005A61000-memory.dmp
memory/3968-5-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/3968-3-0x0000000000AD0000-0x0000000000AD1000-memory.dmp