Analysis

  • max time kernel
    153s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    02-09-2021 11:43

General

  • Target

    ürün örnekleri pdf.exe

  • Size

    917KB

  • MD5

    74ddae6f1130eb1417574d1c36811272

  • SHA1

    233885c441c6415b0caeb7257fe4024172f05035

  • SHA256

    e6ea3a65882a66ce80f1567ea6e7daab614a3dcc269ad4ade427e60be64fc255

  • SHA512

    0a8c835a558dd7715ec8abfca95b45c01e5dded4085d641ac4fb23851969ec389cc82ccd2f89dfffaa6e6b867caa7d255c0f4ec08cd3ed712dbefcaf79b7e3fd

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n7ak

C2

http://www.kmresults.com/n7ak/

Decoy

modischoolcbse.com

theneverwinter.com

rszkjx-vps-hosting.website

fnihil.com

1pbet.com

nnowzscorrez.com

uaotgvjl.icu

starmapsqatar.com

ekisilani.com

extradeepsheets.com

jam-nins.com

buranly.com

orixentertainment.com

rawtech.energy

myol.guru

utex.club

jiapie.com

wowig.store

wweidlyyl.com

systaskautomation.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:808
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CyLcKKHcd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2FDB.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2036
      • C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:640
    • C:\Windows\SysWOW64\NETSTAT.EXE
      "C:\Windows\SysWOW64\NETSTAT.EXE"
      2⤵
      • Suspicious use of SetThreadContext
      • Gathers network information
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\ürün örnekleri pdf.exe"
        3⤵
          PID:3876

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Command-Line Interface

    1
    T1059

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp2FDB.tmp
      MD5

      862c2230c6323650837e496fc3a2e4fa

      SHA1

      2f50377ee6e16c9548c6886d18feb00f0f7720d9

      SHA256

      7b8ba9aa096287865cc3c8843d46d5231e630682adbab30da2c3383997447d0b

      SHA512

      15bd52a52caf1c39fbdcb36e02b87c71ee945e52fecdc92c78b32bcead9ecba7c435cc635d29c372302062bf05812da6db526bad09cbbef1be3d8ccc35b034b6

    • memory/640-129-0x0000000001290000-0x00000000015B0000-memory.dmp
      Filesize

      3.1MB

    • memory/640-130-0x0000000000FA0000-0x0000000000FB4000-memory.dmp
      Filesize

      80KB

    • memory/640-128-0x000000000041ECE0-mapping.dmp
    • memory/640-127-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/808-121-0x00000000052C0000-0x00000000052C1000-memory.dmp
      Filesize

      4KB

    • memory/808-116-0x0000000005040000-0x0000000005041000-memory.dmp
      Filesize

      4KB

    • memory/808-122-0x0000000004A60000-0x0000000004A6E000-memory.dmp
      Filesize

      56KB

    • memory/808-123-0x000000000DCD0000-0x000000000DD61000-memory.dmp
      Filesize

      580KB

    • memory/808-124-0x0000000006D60000-0x0000000006DA0000-memory.dmp
      Filesize

      256KB

    • memory/808-114-0x00000000006E0000-0x00000000006E1000-memory.dmp
      Filesize

      4KB

    • memory/808-120-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
      Filesize

      4KB

    • memory/808-119-0x00000000050E0000-0x00000000055DE000-memory.dmp
      Filesize

      5.0MB

    • memory/808-118-0x00000000050E0000-0x00000000050E1000-memory.dmp
      Filesize

      4KB

    • memory/808-117-0x00000000055E0000-0x00000000055E1000-memory.dmp
      Filesize

      4KB

    • memory/1568-133-0x0000000000F80000-0x0000000000F8B000-memory.dmp
      Filesize

      44KB

    • memory/1568-132-0x0000000000000000-mapping.dmp
    • memory/1568-134-0x0000000000A20000-0x0000000000A4E000-memory.dmp
      Filesize

      184KB

    • memory/1568-135-0x00000000032D0000-0x00000000035F0000-memory.dmp
      Filesize

      3.1MB

    • memory/1568-137-0x0000000003080000-0x0000000003113000-memory.dmp
      Filesize

      588KB

    • memory/2036-125-0x0000000000000000-mapping.dmp
    • memory/3056-131-0x0000000003290000-0x000000000338A000-memory.dmp
      Filesize

      1000KB

    • memory/3056-138-0x00000000057D0000-0x00000000058B1000-memory.dmp
      Filesize

      900KB

    • memory/3876-136-0x0000000000000000-mapping.dmp