Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
23-07-2021 12:51
General
-
Target
Documents pdf.exe
-
Size
533KB
-
MD5
027d8e07155bc564f7b522183018efe6
-
SHA1
10348a89cc88e0911f507a2d4aa50071718b096c
-
SHA256
90e7c97ea4917a6efb5c0a69bd6f481b1a5023d6f8ad0f22d123c417edff8a68
-
SHA512
5d1c8f6f0121df79767de6de22e7f513972aceeafd7376086511c8575187e224190a408340ec57835e9c0e0a347d47d7e4fd70c8618f91cf638c23b3acc5c3d3
Malware Config
Extracted
formbook
4.1
http://www.valiantfinancial.net/hth0/
grahamandjana.com
surfpodcastnetwork.com
valkyrie20.com
hire4looks.com
wewalkfastasone.com
saveourschoolyear.com
5g23e.com
abusinesssystems.com
telefonepantalla.com
tailorscafe.com
schwarzer-markt.net
stopwatch247.com
458grandbetting.com
xpovision.com
kutkingbarbering.life
kppp-guxxz.xyz
chuckwagon-chow.com
la-casa-delle-vita.com
creativesocials.com
negociacoeshojebr.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PwTRIU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDEAD.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
aaa5360ab8a4ab5e7146831fece6dae0
SHA106c876063886c62ab7b13e8667b08f05f1e4d70c
SHA25610359765d76af441571eb362670db684dde9c5f0a4c274b9e5ddba23e4172133
SHA512225fd5b640addc4375ad3975d96110587374f22ff882473608b39b2393f9a20676406d330453d7d24c8a41e2450386b5c2dbdb5873616a2e6e83fa95d3e1e297
-
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
552KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
412KB
-
Filesize
184KB
-
-
Filesize
1.3MB
-
Filesize
3.1MB
-
Filesize
1.6MB
-
Filesize
1.4MB
-
-
Filesize
184KB
-
Filesize
4.2MB
-
Filesize
3.1MB
-
Filesize
588KB
-