Analysis
- max time kernel
154s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/10/2021, 09:04
General
- Target ARRIVAL NOTICE MAERSK_PDF.exe
- Size 595KB
- Sample211006-k1l2wabbcj
- SHA256 b66060a214c372ff66b8917fee39b5cb6c82972cf7cdfcd64b9ae4b7b7e01bf7
Malware Config
Extracted
-
formbook
-
4.1
-
s0vc
-
http://www.xn--289an7fmsbe2rud327e.com/s0vc/
-
redstonemanagers.com
-
graffitiparktx.com
-
aliturk.com
-
asicsmalaysiasale.com
-
primetimehandyman.com
-
logjed068.xyz
-
rusicedream.com
-
rickcaronmuseum.com
-
softwarebuynow.com
-
buddysbarkery.com
-
ysm99.com
-
rtetrgwgre.xyz
-
97020.xyz
-
utahblind.site
-
hiyym.com
-
rohukager.xyz
-
vcstudentwork.com
-
oxfordautomotivepa.com
-
salibrown.com
-
tekosocks.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ARRIVAL NOTICE MAERSK_PDF.exe"C:\Users\Admin\AppData\Local\Temp\ARRIVAL NOTICE MAERSK_PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ARRIVAL NOTICE MAERSK_PDF.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\ARRIVAL NOTICE MAERSK_PDF.exe"C:\Users\Admin\AppData\Local\Temp\ARRIVAL NOTICE MAERSK_PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ARRIVAL NOTICE MAERSK_PDF.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1000-121-0x00000000057A0000-0x00000000057A1000-memory.dmp
memory/1000-122-0x0000000008BC0000-0x0000000008C11000-memory.dmp
memory/1000-117-0x0000000005800000-0x0000000005801000-memory.dmp
memory/1000-118-0x0000000005760000-0x0000000005761000-memory.dmp
memory/1000-119-0x00000000087D0000-0x00000000087D1000-memory.dmp
memory/1000-120-0x0000000005AF0000-0x0000000005AFA000-memory.dmp
memory/1000-116-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/1000-114-0x0000000000D50000-0x0000000000D51000-memory.dmp
memory/2180-384-0x00000000064B0000-0x0000000006561000-memory.dmp
memory/2180-140-0x00000000030F0000-0x00000000031B0000-memory.dmp
memory/2608-138-0x0000000001330000-0x0000000001650000-memory.dmp
memory/2608-124-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2608-139-0x00000000012E0000-0x00000000012F4000-memory.dmp
memory/3524-135-0x0000000006800000-0x0000000006801000-memory.dmp
memory/3524-162-0x000000007F500000-0x000000007F501000-memory.dmp
memory/3524-134-0x00000000078A0000-0x00000000078A1000-memory.dmp
memory/3524-137-0x0000000006802000-0x0000000006803000-memory.dmp
memory/3524-132-0x0000000006D60000-0x0000000006D61000-memory.dmp
memory/3524-131-0x0000000006B80000-0x0000000006B81000-memory.dmp
memory/3524-136-0x0000000007C10000-0x0000000007C11000-memory.dmp
memory/3524-130-0x0000000006AE0000-0x0000000006AE1000-memory.dmp
memory/3524-129-0x0000000006E40000-0x0000000006E41000-memory.dmp
memory/3524-141-0x0000000007B60000-0x0000000007B61000-memory.dmp
memory/3524-149-0x0000000008930000-0x0000000008963000-memory.dmp
memory/3524-156-0x0000000008910000-0x0000000008911000-memory.dmp
memory/3524-161-0x0000000008A70000-0x0000000008A71000-memory.dmp
memory/3524-133-0x0000000007470000-0x0000000007471000-memory.dmp
memory/3524-163-0x0000000008E30000-0x0000000008E31000-memory.dmp
memory/3524-233-0x0000000006803000-0x0000000006804000-memory.dmp
memory/3524-128-0x0000000000C30000-0x0000000000C31000-memory.dmp
memory/3524-368-0x0000000006710000-0x0000000006711000-memory.dmp
memory/3524-362-0x0000000006720000-0x0000000006721000-memory.dmp
memory/4072-237-0x0000000003360000-0x00000000034AA000-memory.dmp
memory/4072-236-0x0000000003330000-0x000000000335F000-memory.dmp
memory/4072-235-0x00000000001C0000-0x0000000000219000-memory.dmp
memory/4072-383-0x00000000039A0000-0x0000000003A33000-memory.dmp