Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
07-05-2021 06:37
General
-
Target
NEW ORDER.exe
-
Size
277KB
-
MD5
fdb13566001939b797325265bc1048e0
-
SHA1
096a63354f73bcc105030ede2f04c5bb12cf2711
-
SHA256
3f2cdc7783014a37d7ad61ee00c226d5221d4932f4113eb3590a9c9d0447b461
-
SHA512
faac103a3a220885b3e4ec848e384e9b8b7ce9a19ab90c97d6319106e0a00275b0d6a51ab94e63bad147e2bcb32cc8ef051705c3b5e019ae1374cfdb901bf934
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c340305243a686b51804d971ea98eb58
SHA1b097ab251863dc844a79dcbee454548baa08d58a
SHA2565e4c6ac84b748a87ad634ae0b05095487272d08e47ca62538e07e83e3e9ca7cd
SHA51255e3c59224b820564a0cfa819e74b02c424dc94abc1da4e7e64f46dc5ee1fbb8cdc5733e89ce97ad3ef37578fe3e2c08729d06df37eac0dccc7f055629ed7785
-
Filesize
4.2MB
-
Filesize
588KB
-
Filesize
184KB
-
Filesize
3.1MB
-
-
-
Filesize
140KB
-
Filesize
3.1MB
-
Filesize
80KB
-
Filesize
184KB
-
-
Filesize
1.4MB
-
Filesize
1.5MB