Analysis
- max time kernel
149s - max time network
142s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/03/2021, 05:18
General
- Target PO_210311.exe
- Size 691KB
- Sample210311-kth6yfdncx
- SHA256 cccbd0b2d46adeb6d99413af4d5a4492cd530922a09724f04c8fb1e0c47d8326
Malware Config
Extracted
-
formbook
-
http://www.avonvalleycollege.com/kbc/
-
ross76.com
-
modabyboutique.com
-
zenabode.store
-
peakorgmush.net
-
superchargelab.com
-
mumaniu.net
-
18costleyst.com
-
moreroomy.com
-
creativecardsnappanee.com
-
jameshamiltonphoto.com
-
amimania.com
-
ahaihealing.com
-
thecopy.coach
-
caishen2587.com
-
bigdickquick.com
-
suojincn.com
-
2020rl.com
-
jointbah.com
-
teddingtonstudios.com
-
javre.club
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\PO_210311.exe"C:\Users\Admin\AppData\Local\Temp\PO_210311.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hWzKYvFJySnd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDED8.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\PO_210311.exe"C:\Users\Admin\AppData\Local\Temp\PO_210311.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PO_210311.exe"C:\Users\Admin\AppData\Local\Temp\PO_210311.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO_210311.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/552-15-0x0000000000400000-0x000000000042E000-memory.dmp
memory/552-21-0x0000000001240000-0x0000000001254000-memory.dmp
memory/552-20-0x0000000001200000-0x0000000001214000-memory.dmp
memory/552-19-0x0000000000EC0000-0x00000000011E0000-memory.dmp
memory/904-28-0x0000000005090000-0x0000000005123000-memory.dmp
memory/904-27-0x00000000052D0000-0x00000000055F0000-memory.dmp
memory/904-25-0x0000000000D60000-0x0000000000ED3000-memory.dmp
memory/904-26-0x00000000032E0000-0x000000000330E000-memory.dmp
memory/2896-22-0x00000000053B0000-0x0000000005471000-memory.dmp
memory/2896-18-0x0000000002B60000-0x0000000002C3E000-memory.dmp
memory/2896-29-0x0000000005480000-0x0000000005593000-memory.dmp
memory/4708-9-0x0000000007810000-0x0000000007811000-memory.dmp
memory/4708-10-0x00000000075D0000-0x00000000075DC000-memory.dmp
memory/4708-2-0x0000000073FA0000-0x000000007468E000-memory.dmp
memory/4708-11-0x00000000075E0000-0x00000000075E1000-memory.dmp
memory/4708-8-0x00000000075B0000-0x00000000075B1000-memory.dmp
memory/4708-7-0x0000000007630000-0x0000000007631000-memory.dmp
memory/4708-6-0x0000000007A90000-0x0000000007A91000-memory.dmp
memory/4708-5-0x00000000074F0000-0x00000000074F1000-memory.dmp
memory/4708-3-0x0000000000630000-0x0000000000631000-memory.dmp
memory/4708-12-0x000000000B520000-0x000000000B58F000-memory.dmp