Analysis
- max time kernel
149s - max time network
147s - platform
windows10_x64 - resource
win10v20201028 - submitted
23/02/2021, 07:22
General
- Target PO_210223.exe
- Size 783KB
- Sample210223-bpphp3tkt2
- SHA256 38acc90cd6d33b61b99cca8cf06781e1bd2ab8ffebc3a33e036eca36037d413b
Malware Config
Extracted
-
formbook
-
http://www.000666dy.com/ntg/
-
successwithyolandafgreen.com
-
theordinaryph.com
-
atamyo-therapeutics.com
-
pophazard.com
-
anthonyfultz.com
-
pasanglham.com
-
kanekhushi.com
-
littlefishyswim.com
-
kaieteurny.com
-
fanavartima.com
-
digexpo.com
-
se-rto.com
-
chaos.finance
-
bakldx.com
-
after-school.pro
-
faithfromphilly.com
-
estudiomuradian.com
-
albertocerasini.com
-
andronna.com
-
wingspotusa.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kwqifureL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1EAF.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/412-3-0x0000000000FC0000-0x0000000000FC1000-memory.dmp
memory/412-5-0x0000000007D60000-0x0000000007D61000-memory.dmp
memory/412-6-0x0000000008300000-0x0000000008301000-memory.dmp
memory/412-7-0x0000000007EA0000-0x0000000007EA1000-memory.dmp
memory/412-8-0x0000000007E20000-0x0000000007E21000-memory.dmp
memory/412-9-0x0000000008000000-0x0000000008001000-memory.dmp
memory/412-10-0x0000000007D20000-0x0000000007D21000-memory.dmp
memory/412-11-0x0000000008240000-0x0000000008243000-memory.dmp
memory/412-12-0x0000000009AF0000-0x0000000009B45000-memory.dmp
memory/412-2-0x0000000073970000-0x000000007405E000-memory.dmp
memory/1112-15-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1112-19-0x0000000001900000-0x0000000001C20000-memory.dmp
memory/1112-20-0x0000000001410000-0x0000000001424000-memory.dmp
memory/1680-21-0x0000000006250000-0x00000000063D4000-memory.dmp
memory/1680-29-0x0000000002BA0000-0x0000000002C36000-memory.dmp
memory/2136-23-0x0000000000D70000-0x0000000000D90000-memory.dmp
memory/2136-24-0x0000000004660000-0x0000000004980000-memory.dmp
memory/2136-25-0x00000000006D0000-0x00000000006FE000-memory.dmp
memory/2136-28-0x00000000044C0000-0x0000000004553000-memory.dmp