Analysis
- max time kernel
150s - max time network
135s - platform
windows10_x64 - resource
win10-en - submitted
02/09/2021, 13:48
General
- Target Shipment Document BLINV and packing list.jpg.exe
- Size 160KB
- Sample210902-q34btsabd8
- SHA256 ace7e59fa80a108d4f3fd0a56a99f03d17e56ec2c756092aa65b910352f59921
Malware Config
Extracted
-
formbook
-
4.1
-
bur0
-
http://www.mariahoeflriesch.com/bur0/
-
purray.com
-
momof4plusmore.com
-
evebreastprosthetics.com
-
buddharugs.com
-
ajtcopy.com
-
photocoopfolkestone.com
-
handseshop.com
-
mrfix-leaking-roof.com
-
lifeisharmony.com
-
lightgraydesign.com
-
investearnrepeat.com
-
ortessi.com
-
myvcabenifits.com
-
54yyommwexbcex.xyz
-
carboma.net
-
zhongliudayi.com
-
mechanics-kansascity.com
-
palmkingfarms.com
-
fridayiminlovexo.com
-
univernegocios.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Formbook Payload 2 IoCs
- Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BLINV and packing list.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BLINV and packing list.jpg.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BLINV and packing list.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BLINV and packing list.jpg.exe"3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipment Document BLINV and packing list.jpg.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2060-128-0x000000001E820000-0x000000001EB40000-memory.dmp
memory/2060-127-0x0000000000401000-0x0000000000541000-memory.dmp
memory/2060-119-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2060-120-0x0000000000401000-0x00000000004FD000-memory.dmp
memory/2060-131-0x00000000000A0000-0x00000000000B4000-memory.dmp
memory/2060-129-0x000000001E620000-0x000000001E634000-memory.dmp
memory/2060-126-0x0000000077A50000-0x0000000077BDE000-memory.dmp
memory/2060-125-0x00007FFA56390000-0x00007FFA5656B000-memory.dmp
memory/2060-124-0x0000000000560000-0x0000000000660000-memory.dmp
memory/2368-136-0x0000000000AC0000-0x0000000000AEE000-memory.dmp
memory/2368-137-0x0000000004A20000-0x0000000004D40000-memory.dmp
memory/2368-135-0x0000000000D60000-0x0000000000D6C000-memory.dmp
memory/2368-138-0x0000000004880000-0x0000000004913000-memory.dmp
memory/3008-132-0x0000000005EC0000-0x000000000606A000-memory.dmp
memory/3008-130-0x00000000033C0000-0x0000000003484000-memory.dmp
memory/3008-139-0x0000000006D50000-0x0000000006E7E000-memory.dmp
memory/4008-117-0x00000000022A0000-0x00000000022B3000-memory.dmp
memory/4008-123-0x0000000077A50000-0x0000000077BDE000-memory.dmp
memory/4008-122-0x0000000077A50000-0x0000000077BDE000-memory.dmp
memory/4008-121-0x00007FFA56390000-0x00007FFA5656B000-memory.dmp