Analysis

  • max time kernel
    150s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    21-04-2021 17:05

General

  • Target

    pending orders0308 D2101002610 pdf.exe

  • Size

    1MB

  • MD5

    346fb2689c7f90207ce5df0b60be8b14

  • SHA1

    3eee0df26d21393485821a95c2beffc8797d090b

  • SHA256

    6a900970eda971ac9e4cc4263b78b6145ef6c5a94783c572805fdf3c85a8503a

  • SHA512

    9875b395dc34b35f011916d89f3647b155821a4627256d1a7fd3c7af655dcec1e153b1ddcd764e957a404547c4cb6b930afbc358f065ec9671030cf82edf02f8

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.gloomyca.com/chue/

Decoy

hairdewproducts.com

whssboys.net

visual-promotions.com

alsgotyaexteriorcleaning.com

conwayconsultant.com

sjlartistrydesign.info

organicroomservice.com

elatedscents.com

selfauthering.com

variablemonsters.com

thedietcop.com

openhouseshamptonroads.com

tyrantthemes.com

trumppowercatamarans.com

yznx.xyz

jshfoodpantry.com

larmealoeil.com

biztradelines.com

axawinterthur.sucks

inspiredtravels.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\pending orders0308 D2101002610 pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\pending orders0308 D2101002610 pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Users\Admin\AppData\Local\Temp\pending orders0308 D2101002610 pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\pending orders0308 D2101002610 pdf.exe"
        3⤵
          PID:1188
        • C:\Users\Admin\AppData\Local\Temp\pending orders0308 D2101002610 pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\pending orders0308 D2101002610 pdf.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1688
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\SysWOW64\wscript.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:800
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:1752

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Collection

      Data from Local System

      1
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/800-73-0x0000000000000000-mapping.dmp
      • memory/800-78-0x0000000001D00000-0x0000000001D93000-memory.dmp
        Filesize

        588KB

      • memory/800-77-0x0000000001FD0000-0x00000000022D3000-memory.dmp
        Filesize

        3MB

      • memory/800-75-0x00000000005B0000-0x00000000005D6000-memory.dmp
        Filesize

        152KB

      • memory/800-76-0x00000000000B0000-0x00000000000DE000-memory.dmp
        Filesize

        184KB

      • memory/800-74-0x0000000075551000-0x0000000075553000-memory.dmp
        Filesize

        8KB

      • memory/1244-72-0x0000000003EF0000-0x0000000003FDC000-memory.dmp
        Filesize

        944KB

      • memory/1244-79-0x0000000004E20000-0x0000000004F74000-memory.dmp
        Filesize

        1MB

      • memory/1632-65-0x0000000004A70000-0x0000000004AEA000-memory.dmp
        Filesize

        488KB

      • memory/1632-60-0x0000000001290000-0x0000000001291000-memory.dmp
        Filesize

        4KB

      • memory/1632-66-0x0000000000E70000-0x0000000000EA3000-memory.dmp
        Filesize

        204KB

      • memory/1632-64-0x000000007EF40000-0x000000007EF41000-memory.dmp
        Filesize

        4KB

      • memory/1632-63-0x00000000007E0000-0x00000000007E9000-memory.dmp
        Filesize

        36KB

      • memory/1632-62-0x00000000050C0000-0x00000000050C1000-memory.dmp
        Filesize

        4KB

      • memory/1688-71-0x0000000000150000-0x0000000000164000-memory.dmp
        Filesize

        80KB

      • memory/1688-68-0x000000000041ED00-mapping.dmp
      • memory/1688-67-0x0000000000400000-0x000000000042E000-memory.dmp
        Filesize

        184KB

      • memory/1688-70-0x0000000000A40000-0x0000000000D43000-memory.dmp
        Filesize

        3MB

      • memory/1752-80-0x0000000000000000-mapping.dmp
      • memory/1752-81-0x000000013F020000-0x000000013F0B3000-memory.dmp
        Filesize

        588KB

      • memory/1752-82-0x0000000000060000-0x000000000011A000-memory.dmp
        Filesize

        744KB