Analysis
- max time kernel
150s - max time network
133s - platform
windows7_x64 - resource
win7v20210410 - submitted
22/07/2021, 11:17
General
- Target Purchase Order.exe
- Size 916KB
- Sample210722-ln67kvfrvx
- SHA256 419d8b92dc042882bb3261de70dfe4a158bc9ca436c71f9bf330bb8a6917d04c
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.valiantfinancial.net/hth0/
-
grahamandjana.com
-
surfpodcastnetwork.com
-
valkyrie20.com
-
hire4looks.com
-
wewalkfastasone.com
-
saveourschoolyear.com
-
5g23e.com
-
abusinesssystems.com
-
telefonepantalla.com
-
tailorscafe.com
-
schwarzer-markt.net
-
stopwatch247.com
-
458grandbetting.com
-
xpovision.com
-
kutkingbarbering.life
-
kppp-guxxz.xyz
-
chuckwagon-chow.com
-
la-casa-delle-vita.com
-
creativesocials.com
-
negociacoeshojebr.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1260-79-0x00000000050E0000-0x0000000005213000-memory.dmp
memory/1260-71-0x0000000004F70000-0x00000000050DB000-memory.dmp
memory/1652-67-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1652-69-0x0000000000920000-0x0000000000C23000-memory.dmp
memory/1652-70-0x0000000000280000-0x0000000000294000-memory.dmp
memory/1732-65-0x0000000004E80000-0x0000000004EFE000-memory.dmp
memory/1732-66-0x0000000000CC0000-0x0000000000CF0000-memory.dmp
memory/1732-60-0x0000000000D00000-0x0000000000D01000-memory.dmp
memory/1732-64-0x00000000008D0000-0x00000000008D2000-memory.dmp
memory/1732-63-0x0000000004470000-0x0000000004471000-memory.dmp
memory/1732-62-0x0000000000B20000-0x0000000000B7E000-memory.dmp
memory/1872-73-0x0000000075161000-0x0000000075163000-memory.dmp
memory/1872-75-0x0000000000430000-0x000000000043E000-memory.dmp
memory/1872-76-0x0000000000090000-0x00000000000BE000-memory.dmp
memory/1872-77-0x0000000002050000-0x0000000002353000-memory.dmp
memory/1872-78-0x0000000001EC0000-0x0000000001F53000-memory.dmp