Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-05-2021 18:03
General
-
Target
SHIPPING DOCUMENT.exe
-
Size
228KB
-
MD5
25e847b9631bc2fe8d87fe4278fa142e
-
SHA1
641756a84fdce68e101a53cfa6809b68190b7ad7
-
SHA256
70dfd7bc81878d265e39803f73f55af96d7bf2a336408b52cc6005785fbe0415
-
SHA512
82c1e56fa6a6611c45057c80190d2d7d220294a690044a164cdda39bc5e26b8c35d76433e3b1d7d247ef464d3307911a4a4337e52163177f4322fbe67579dabd
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsp78E1.tmp\2x6gdfzk.dllMD5
45adfa33a0e6a780e55f543a36143542
SHA1540bbbf9ec26ddef911ba80ee0365cf23b687749
SHA2565299a5c9ba1296db0a9f804741b58ec7a0fedaef8937e3cdc21d3523e0449ee3
SHA5122ad608026d78dedd9f803b6a2f7e27e5590d9df5870adeccbdfc353b1d546450075743b499ebcf57f8d67886188db92ba8f968b4d71fed624fd948d3b047a0e3
-
memory/632-125-0x0000000000000000-mapping.dmp
-
memory/2088-124-0x0000000004490000-0x00000000047B0000-memory.dmpFilesize
3.1MB
-
memory/2088-126-0x00000000041F0000-0x0000000004283000-memory.dmpFilesize
588KB
-
memory/2088-123-0x0000000000A00000-0x0000000000A2E000-memory.dmpFilesize
184KB
-
memory/2088-121-0x0000000000000000-mapping.dmp
-
memory/2088-122-0x0000000000D30000-0x0000000000D4F000-memory.dmpFilesize
124KB
-
memory/2900-127-0x0000000006420000-0x0000000006528000-memory.dmpFilesize
1.0MB
-
memory/2900-120-0x0000000002EC0000-0x0000000002F9A000-memory.dmpFilesize
872KB
-
memory/3200-117-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3200-118-0x0000000000AA0000-0x0000000000DC0000-memory.dmpFilesize
3.1MB
-
memory/3200-119-0x00000000005E0000-0x00000000005F4000-memory.dmpFilesize
80KB
-
memory/3200-115-0x000000000041EAF0-mapping.dmp
-
memory/4804-116-0x0000000000AB0000-0x0000000000AD3000-memory.dmpFilesize
140KB