Analysis
- max time kernel
149s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
27/01/2021, 14:31
General
- Target Order confirmation 64236000000025 26.01.2021.exe
- Size 582KB
- Sample210127-tel314wk2j
- SHA256 238dd9cb9b1c235e2babbc3f3b1372da8d76e4d94a4440776814957e0fd09f0b
Malware Config
Extracted
-
formbook
-
http://www.dmvantalya.com/bnuw/
-
amgggma.com
-
reptilerus.com
-
degearboss.com
-
jennaelsbakeshop.com
-
invisablescreen.com
-
beingsingleda.com
-
2nsupplements.online
-
12862.xyz
-
expand.care
-
romeoalchimistefullmental.com
-
7750166.com
-
brendonellis.com
-
sprayfoamharlemny.com
-
bukannyaterbuai30.com
-
boatpiz.com
-
stylistrx.com
-
decorationhaven.com
-
stockaro.com
-
state728.com
-
secretlairtoys.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 70 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order confirmation 64236000000025 26.01.2021.exe"C:\Users\Admin\AppData\Local\Temp\Order confirmation 64236000000025 26.01.2021.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nla\lqqebhptsg.exeC:\Users\Admin\AppData\Local\Temp\Nla\lqqebhptsg.exe C:\Users\Admin\AppData\Local\Temp\Nla\kwalgxu.u3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nla\9rd1hxro.exeC:\Users\Admin\AppData\Local\Temp\Nla\lqqebhptsg.exe C:\Users\Admin\AppData\Local\Temp\Nla\kwalgxu.u4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Nla\9rd1hxro.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2092-21-0x0000000005780000-0x00000000058BB000-memory.dmp
memory/2092-13-0x0000000005650000-0x000000000577D000-memory.dmp
memory/2228-7-0x0000000000B20000-0x0000000000B22000-memory.dmp
memory/3512-12-0x00000000004A0000-0x00000000004B0000-memory.dmp
memory/3512-10-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3512-11-0x0000000000E70000-0x0000000001190000-memory.dmp
memory/3972-16-0x0000000000360000-0x0000000000388000-memory.dmp
memory/3972-15-0x0000000000C50000-0x0000000000C5B000-memory.dmp
memory/3972-17-0x0000000002C60000-0x0000000002F80000-memory.dmp
memory/3972-20-0x0000000002F80000-0x000000000300F000-memory.dmp