Analysis
- max time kernel
150s - max time network
148s - platform
windows10_x64 - resource
win10v20210408 - submitted
19/04/2021, 15:40
General
- Target Order PO #5544 TULIP GROUP LLC , PDF.exe
- Size 1.1MB
- Sample210419-b4he71vja2
- SHA256 61b1619f5d3f4708cb0da8b1fc6b148d7e5352516c3e16fae6faffb503fa413b
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.anayonbattery.com/ewws/
-
gesundheitscoaching.one
-
leonspropertysolutions.com
-
urbancoderz.com
-
abybo.com
-
crybabysmensclub.com
-
russiaentertainment.com
-
lfgprima.com
-
snatchtime.net
-
cnrollershoes.com
-
gdddpc.com
-
psychicpatrol.com
-
minnienucup.com
-
thankscred.com
-
huellanaranja.com
-
office365microsoft.com
-
nisithailand.com
-
jumlasx.xyz
-
edm191.com
-
cleaoshop.com
-
najjarnabil.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order PO #5544 TULIP GROUP LLC , PDF.exe"C:\Users\Admin\AppData\Local\Temp\Order PO #5544 TULIP GROUP LLC , PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HaUyJYhUmv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6E2.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Order PO #5544 TULIP GROUP LLC , PDF.exe"C:\Users\Admin\AppData\Local\Temp\Order PO #5544 TULIP GROUP LLC , PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order PO #5544 TULIP GROUP LLC , PDF.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1320-131-0x0000000000E50000-0x0000000000E64000-memory.dmp
memory/1320-130-0x0000000000ED0000-0x00000000011F0000-memory.dmp
memory/1320-127-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3016-139-0x00000000032D0000-0x000000000338F000-memory.dmp
memory/3016-132-0x0000000006AA0000-0x0000000006BCF000-memory.dmp
memory/3260-121-0x0000000004A00000-0x0000000004A92000-memory.dmp
memory/3260-118-0x0000000004B80000-0x0000000004B81000-memory.dmp
memory/3260-123-0x0000000000A60000-0x0000000000ADB000-memory.dmp
memory/3260-122-0x0000000004F50000-0x0000000004F56000-memory.dmp
memory/3260-114-0x0000000000120000-0x0000000000121000-memory.dmp
memory/3260-120-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/3260-119-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/3260-124-0x0000000007D30000-0x0000000007D63000-memory.dmp
memory/3260-116-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/3260-117-0x0000000005080000-0x0000000005081000-memory.dmp
memory/3636-135-0x0000000005000000-0x000000000502E000-memory.dmp
memory/3636-134-0x00000000008A0000-0x00000000008AA000-memory.dmp
memory/3636-137-0x0000000005680000-0x00000000059A0000-memory.dmp
memory/3636-138-0x00000000053E0000-0x0000000005473000-memory.dmp