Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 11:28
General
-
Target
SHIPPING DOCUMENT.exe
-
Size
229KB
-
MD5
2a7d9a26f63de29bbf21016b055560b1
-
SHA1
8110d53cc373121512c1fb90c4ce12fedc07803a
-
SHA256
2a728511ab345b4207ea5959439df12205796548388cc170b427110f9cc247dd
-
SHA512
4bb88aaa2c8f9d8d3ecbc53910b20c1eb121222f31503792196cac567f640125e75e92c99147732d24db24ae7d81f01a0fca7c1ba3627a1565c9702e89303cc3
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsp209F.tmp\yg69z2kr0.dllMD5
cf41dfdbe7d97c55ed8f185286d3c113
SHA14113c1310169af016c663b562bc6a65c60a9618a
SHA2567f2094ea72a8f87da7b2291f0093567b6ba766442f024b5be3f81ade371e7c22
SHA5122c034c004deb528d8c417781e5f786cf45ff66651662a524b37dab11a6b7616cfc3009daa1e8749d6c0255fed3f89d63956ff441653293467a68758803f1dd3f
-
memory/1852-116-0x0000000002160000-0x0000000002162000-memory.dmpFilesize
8KB
-
memory/2328-118-0x00000000009E0000-0x0000000000D00000-memory.dmpFilesize
3.1MB
-
memory/2328-117-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2328-119-0x0000000000D00000-0x0000000000D14000-memory.dmpFilesize
80KB
-
memory/2328-115-0x000000000041EAF0-mapping.dmp
-
memory/2596-125-0x0000000000000000-mapping.dmp
-
memory/2680-120-0x0000000005A90000-0x0000000005BA5000-memory.dmpFilesize
1.1MB
-
memory/2680-127-0x0000000005BB0000-0x0000000005D23000-memory.dmpFilesize
1.4MB
-
memory/2704-121-0x0000000000000000-mapping.dmp
-
memory/2704-122-0x00000000008A0000-0x00000000008B3000-memory.dmpFilesize
76KB
-
memory/2704-123-0x0000000004630000-0x0000000004950000-memory.dmpFilesize
3.1MB
-
memory/2704-124-0x0000000000370000-0x000000000039E000-memory.dmpFilesize
184KB
-
memory/2704-126-0x00000000042F0000-0x0000000004383000-memory.dmpFilesize
588KB