Analysis
- max time kernel
150s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
21/02/2021, 15:53
General
- Target ORDER CONFIRMATION.exe
- Size 665KB
- Sample210221-any91ngdlx
- SHA256 357c55fac31eb641cb3cec37663a829e2745f3cd4af08b6fc0c1634ef3eee1b6
Malware Config
Extracted
-
formbook
-
http://www.fun4gang.xyz/thg/
-
retrospectphotographydesign.com
-
jafodraws.com
-
cigiwie.space
-
upgradecarehealth.com
-
12ts.xyz
-
111indianbend.com
-
qqchbakery.com
-
0831xx.com
-
supecret.com
-
ayfadopple.com
-
coldwateradvisors.com
-
forexgiftcard.com
-
actionconsultingchile.com
-
mpsconcrete.net
-
carmallc.com
-
b167888.com
-
simonking.xyz
-
elitedigitalperformance.com
-
essentialjanitorialservices.com
-
barcosocasionberga.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER CONFIRMATION.exe"C:\Users\Admin\AppData\Local\Temp\ORDER CONFIRMATION.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER CONFIRMATION.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ORDER CONFIRMATION.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1048-3-0x00000000007C0000-0x00000000007C1000-memory.dmp
memory/1048-5-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/1048-6-0x00000000050B0000-0x00000000050B1000-memory.dmp
memory/1048-7-0x0000000005160000-0x0000000005161000-memory.dmp
memory/1048-8-0x0000000002C40000-0x0000000002C41000-memory.dmp
memory/1048-9-0x000000000CA20000-0x000000000CA21000-memory.dmp
memory/1048-10-0x000000000C980000-0x000000000C98B000-memory.dmp
memory/1048-11-0x0000000006CD0000-0x0000000006D22000-memory.dmp
memory/1048-2-0x0000000073A30000-0x000000007411E000-memory.dmp
memory/3012-17-0x00000000052B0000-0x0000000005427000-memory.dmp
memory/3012-24-0x0000000005190000-0x0000000005295000-memory.dmp
memory/4004-16-0x0000000001570000-0x0000000001584000-memory.dmp
memory/4004-15-0x0000000001210000-0x0000000001530000-memory.dmp
memory/4004-12-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4076-19-0x0000000000B50000-0x0000000000B6E000-memory.dmp
memory/4076-20-0x0000000003140000-0x000000000316E000-memory.dmp
memory/4076-22-0x00000000033F0000-0x0000000003710000-memory.dmp
memory/4076-23-0x00000000037B0000-0x0000000003843000-memory.dmp