Analysis

  • max time kernel
    146s
  • max time network
    12s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    15-01-2021 07:22

General

  • Target

    SCAN_20210115140930669.exe

  • Size

    892KB

  • MD5

    c0aa1598d486cceab2fdea9a6c41ac0e

  • SHA1

    21263c3f531b81d949bf15c486bc3aeb16b9bb00

  • SHA256

    7aa65f77c48841f9f1545c2e5bb7cb186cd259631c4c449400206f1bb3d16d5e

  • SHA512

    2bba64e13254b3b5dfe98fac0681335a23a801065ffc1a69a80e63d8144067f98edb8c0b252ab8953ac78798dc4b23e4bff188d9ad3508997f6dfa4b7e987c65

Malware Config

Extracted

Family

formbook

C2

http://www.midnightblueinc.com/2kf/

Decoy

edmondscakes.com

doublewldr.online

tickets2usa.com

heyhxry.com

weightloss-gulfport.com

prosselius.com

newviewroofers.com

jacksonarearealestate.com

catparkas.xyz

pagos2020.com

sonwsefjrahi.online

franchisethings.com

nuocvietngaynay.com

sohelvai.com

mikeyroush.com

lamesaroofing.com

betbigo138.com

amazon-service-recovery.com

clockin.net

riostrader.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Users\Admin\AppData\Local\Temp\SCAN_20210115140930669.exe
      "C:\Users\Admin\AppData\Local\Temp\SCAN_20210115140930669.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CuWqoOcxq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F0A.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:1300
      • C:\Users\Admin\AppData\Local\Temp\SCAN_20210115140930669.exe
        "C:\Users\Admin\AppData\Local\Temp\SCAN_20210115140930669.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1700
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:792
      • C:\Windows\SysWOW64\chkdsk.exe
        "C:\Windows\SysWOW64\chkdsk.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\SCAN_20210115140930669.exe"
          3⤵
          • Deletes itself
          PID:1848

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp4F0A.tmp
      MD5

      0860d69be3ca8e253785e0b85151d500

      SHA1

      72f56430c14508e767fb471b0996a8b4b788e1bd

      SHA256

      c136fa6d0060d93637e1fb0f69bbb5d643177a3d4af55c1c40f0b401ac3bcb92

      SHA512

      f8b7478c8beb9b9b20d84e43a58b2c77b74472f85aee254b86b8d388b1d631fc034801f41544c8a505e99357c918f14740f39f063c146dea1e3949bd87799607

    • memory/1300-7-0x0000000000000000-mapping.dmp
    • memory/1312-11-0x0000000000000000-mapping.dmp
    • memory/1312-12-0x0000000000B00000-0x0000000000B07000-memory.dmp
      Filesize

      28KB

    • memory/1312-14-0x0000000003180000-0x000000000329E000-memory.dmp
      Filesize

      1.1MB

    • memory/1700-9-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/1700-10-0x000000000041EB30-mapping.dmp
    • memory/1840-2-0x00000000749E0000-0x00000000750CE000-memory.dmp
      Filesize

      6.9MB

    • memory/1840-3-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
      Filesize

      4KB

    • memory/1840-5-0x0000000000540000-0x0000000000552000-memory.dmp
      Filesize

      72KB

    • memory/1840-6-0x0000000004F90000-0x0000000004FF6000-memory.dmp
      Filesize

      408KB

    • memory/1848-13-0x0000000000000000-mapping.dmp