Analysis

  • max time kernel
    153s
  • max time network
    173s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    02-09-2021 11:43

General

  • Target

    ürün örnekleri pdf.exe

  • Size

    917KB

  • MD5

    74ddae6f1130eb1417574d1c36811272

  • SHA1

    233885c441c6415b0caeb7257fe4024172f05035

  • SHA256

    e6ea3a65882a66ce80f1567ea6e7daab614a3dcc269ad4ade427e60be64fc255

  • SHA512

    0a8c835a558dd7715ec8abfca95b45c01e5dded4085d641ac4fb23851969ec389cc82ccd2f89dfffaa6e6b867caa7d255c0f4ec08cd3ed712dbefcaf79b7e3fd

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n7ak

C2

http://www.kmresults.com/n7ak/

Decoy

modischoolcbse.com

theneverwinter.com

rszkjx-vps-hosting.website

fnihil.com

1pbet.com

nnowzscorrez.com

uaotgvjl.icu

starmapsqatar.com

ekisilani.com

extradeepsheets.com

jam-nins.com

buranly.com

orixentertainment.com

rawtech.energy

myol.guru

utex.club

jiapie.com

wowig.store

wweidlyyl.com

systaskautomation.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CyLcKKHcd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7C51.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:892
      • C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1100
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:848
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe"
        3⤵
        • Deletes itself
        PID:1800

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp7C51.tmp
    MD5

    35e9154bbbf8eadd3785a7a516926fda

    SHA1

    6a4ee5febf967cb888bd8bae7bf720da0a375ba6

    SHA256

    0e1fce11978c4f0cf924a453d776bb12011d91601cdc17c71ba0f05cdd17edf8

    SHA512

    9208c90b0f7d0a6104c93513d5fbc88dd12100f192b1663fddb80df8bfcf309015004d657e99c3a0e39653507ecf6a29e8946506fd93da700480f0623cde16ab

  • memory/848-73-0x0000000000000000-mapping.dmp
  • memory/848-80-0x0000000075801000-0x0000000075803000-memory.dmp
    Filesize

    8KB

  • memory/848-78-0x0000000001DC0000-0x0000000001E53000-memory.dmp
    Filesize

    588KB

  • memory/848-77-0x0000000001EB0000-0x00000000021B3000-memory.dmp
    Filesize

    3.0MB

  • memory/848-76-0x0000000000080000-0x00000000000AE000-memory.dmp
    Filesize

    184KB

  • memory/848-75-0x0000000000910000-0x000000000091D000-memory.dmp
    Filesize

    52KB

  • memory/892-66-0x0000000000000000-mapping.dmp
  • memory/1100-69-0x000000000041ECE0-mapping.dmp
  • memory/1100-71-0x0000000000180000-0x0000000000194000-memory.dmp
    Filesize

    80KB

  • memory/1100-70-0x0000000000A80000-0x0000000000D83000-memory.dmp
    Filesize

    3.0MB

  • memory/1100-68-0x0000000000400000-0x000000000042E000-memory.dmp
    Filesize

    184KB

  • memory/1204-72-0x00000000061A0000-0x00000000062C7000-memory.dmp
    Filesize

    1.2MB

  • memory/1204-79-0x0000000003F60000-0x000000000402D000-memory.dmp
    Filesize

    820KB

  • memory/1800-74-0x0000000000000000-mapping.dmp
  • memory/1804-60-0x0000000000990000-0x0000000000991000-memory.dmp
    Filesize

    4KB

  • memory/1804-65-0x0000000002040000-0x0000000002080000-memory.dmp
    Filesize

    256KB

  • memory/1804-64-0x0000000005EE0000-0x0000000005F71000-memory.dmp
    Filesize

    580KB

  • memory/1804-63-0x0000000000530000-0x000000000053E000-memory.dmp
    Filesize

    56KB

  • memory/1804-62-0x00000000043B0000-0x00000000043B1000-memory.dmp
    Filesize

    4KB