Analysis
- max time kernel
147s - max time network
16s - platform
windows7_x64 - resource
win7v20201028 - submitted
23/02/2021, 07:22
General
- Target PO_210223.exe
- Size 783KB
- Sample210223-bpphp3tkt2
- SHA256 38acc90cd6d33b61b99cca8cf06781e1bd2ab8ffebc3a33e036eca36037d413b
Malware Config
Extracted
-
formbook
-
http://www.000666dy.com/ntg/
-
successwithyolandafgreen.com
-
theordinaryph.com
-
atamyo-therapeutics.com
-
pophazard.com
-
anthonyfultz.com
-
pasanglham.com
-
kanekhushi.com
-
littlefishyswim.com
-
kaieteurny.com
-
fanavartima.com
-
digexpo.com
-
se-rto.com
-
chaos.finance
-
bakldx.com
-
after-school.pro
-
faithfromphilly.com
-
estudiomuradian.com
-
albertocerasini.com
-
andronna.com
-
wingspotusa.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kwqifureL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A3D.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/776-2-0x0000000073D40000-0x000000007442E000-memory.dmp
memory/776-3-0x0000000001010000-0x0000000001011000-memory.dmp
memory/776-5-0x00000000072D0000-0x00000000072D1000-memory.dmp
memory/776-6-0x00000000003D0000-0x00000000003D3000-memory.dmp
memory/776-7-0x00000000074E0000-0x0000000007535000-memory.dmp
memory/808-17-0x0000000075C61000-0x0000000075C63000-memory.dmp
memory/808-19-0x0000000000960000-0x000000000096E000-memory.dmp
memory/808-20-0x0000000000090000-0x00000000000BE000-memory.dmp
memory/808-21-0x0000000002360000-0x0000000002663000-memory.dmp
memory/808-22-0x0000000002040000-0x00000000020D3000-memory.dmp
memory/940-13-0x00000000009E0000-0x0000000000CE3000-memory.dmp
memory/940-14-0x0000000000140000-0x0000000000154000-memory.dmp
memory/940-10-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1248-15-0x0000000004B50000-0x0000000004CBF000-memory.dmp