Analysis

  • max time kernel
    148s
  • max time network
    12s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    21-04-2021 16:07

General

  • Target

    pending orders0308 D2101002610 pdf.exe

  • Size

    1.0MB

  • MD5

    346fb2689c7f90207ce5df0b60be8b14

  • SHA1

    3eee0df26d21393485821a95c2beffc8797d090b

  • SHA256

    6a900970eda971ac9e4cc4263b78b6145ef6c5a94783c572805fdf3c85a8503a

  • SHA512

    9875b395dc34b35f011916d89f3647b155821a4627256d1a7fd3c7af655dcec1e153b1ddcd764e957a404547c4cb6b930afbc358f065ec9671030cf82edf02f8

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.gloomyca.com/chue/

Decoy

hairdewproducts.com

whssboys.net

visual-promotions.com

alsgotyaexteriorcleaning.com

conwayconsultant.com

sjlartistrydesign.info

organicroomservice.com

elatedscents.com

selfauthering.com

variablemonsters.com

thedietcop.com

openhouseshamptonroads.com

tyrantthemes.com

trumppowercatamarans.com

yznx.xyz

jshfoodpantry.com

larmealoeil.com

biztradelines.com

axawinterthur.sucks

inspiredtravels.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Users\Admin\AppData\Local\Temp\pending orders0308 D2101002610 pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\pending orders0308 D2101002610 pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Users\Admin\AppData\Local\Temp\pending orders0308 D2101002610 pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\pending orders0308 D2101002610 pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:316
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\SysWOW64\netsh.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:792
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1068

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/316-71-0x0000000000280000-0x0000000000294000-memory.dmp
      Filesize

      80KB

    • memory/316-70-0x0000000000AC0000-0x0000000000DC3000-memory.dmp
      Filesize

      3.0MB

    • memory/316-73-0x00000000003C0000-0x00000000003D4000-memory.dmp
      Filesize

      80KB

    • memory/316-68-0x000000000041ED00-mapping.dmp
    • memory/316-67-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/792-79-0x0000000075DA1000-0x0000000075DA3000-memory.dmp
      Filesize

      8KB

    • memory/792-80-0x0000000000F40000-0x0000000000FD3000-memory.dmp
      Filesize

      588KB

    • memory/792-77-0x0000000000080000-0x00000000000AE000-memory.dmp
      Filesize

      184KB

    • memory/792-76-0x00000000012C0000-0x00000000012DB000-memory.dmp
      Filesize

      108KB

    • memory/792-78-0x0000000000B90000-0x0000000000E93000-memory.dmp
      Filesize

      3.0MB

    • memory/792-75-0x0000000000000000-mapping.dmp
    • memory/1068-84-0x0000000000060000-0x0000000000127000-memory.dmp
      Filesize

      796KB

    • memory/1068-82-0x0000000000000000-mapping.dmp
    • memory/1068-83-0x000000013FD10000-0x000000013FDA3000-memory.dmp
      Filesize

      588KB

    • memory/1096-66-0x0000000004240000-0x0000000004273000-memory.dmp
      Filesize

      204KB

    • memory/1096-60-0x00000000009B0000-0x00000000009B1000-memory.dmp
      Filesize

      4KB

    • memory/1096-65-0x0000000004B50000-0x0000000004BCA000-memory.dmp
      Filesize

      488KB

    • memory/1096-64-0x000000007EF40000-0x000000007EF41000-memory.dmp
      Filesize

      4KB

    • memory/1096-63-0x0000000000950000-0x0000000000959000-memory.dmp
      Filesize

      36KB

    • memory/1096-62-0x0000000000970000-0x0000000000971000-memory.dmp
      Filesize

      4KB

    • memory/1352-74-0x0000000006B40000-0x0000000006C66000-memory.dmp
      Filesize

      1.1MB

    • memory/1352-72-0x0000000003DE0000-0x0000000003F57000-memory.dmp
      Filesize

      1.5MB

    • memory/1352-81-0x0000000006D10000-0x0000000006E67000-memory.dmp
      Filesize

      1.3MB