Analysis
- max time kernel
149s - max time network
177s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
27/10/2021, 04:04
General
- Target P-Order #102721.exe
- Size 522KB
- Sample211027-emykvsafa4
- SHA256 e4f478b7cd658cb31bc1192e16ccc1509d552a7229a92fea1a3c6224ee7591a1
Malware Config
Extracted
-
formbook
-
4.1
-
cr35
-
http://www.tllyou.com/cr35/
-
tahirsoemantrigroup.com
-
hashtagstartup.net
-
guron.biz
-
donwalin.com
-
aslanrefinedhomes.com
-
quitrobo.com
-
transcriptionservicesindia.com
-
mooremedications.com
-
mahounoniwa.com
-
lowpricepath.com
-
xinmanxin.com
-
maliya-interiors.com
-
rkprops.com
-
functionsandfoundations.com
-
thelenditudenews.com
-
streetlogic.biz
-
itaste.xyz
-
protokolavukatlik.com
-
reformasmende.com
-
noahsicecream.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 4 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\P-Order #102721.exe"C:\Users\Admin\AppData\Local\Temp\P-Order #102721.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\P-Order #102721.exe"C:\Users\Admin\AppData\Local\Temp\P-Order #102721.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\P-Order #102721.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1104-77-0x0000000000AE0000-0x0000000000B73000-memory.dmp
memory/1104-72-0x0000000074761000-0x0000000074763000-memory.dmp
memory/1104-74-0x0000000000D60000-0x0000000000FE1000-memory.dmp
memory/1104-75-0x00000000000C0000-0x00000000000EF000-memory.dmp
memory/1104-76-0x00000000023F0000-0x00000000026F3000-memory.dmp
memory/1112-57-0x0000000000520000-0x0000000000526000-memory.dmp
memory/1112-53-0x0000000000A60000-0x0000000000A61000-memory.dmp
memory/1112-58-0x0000000002280000-0x00000000022D0000-memory.dmp
memory/1112-56-0x0000000004D50000-0x0000000004D51000-memory.dmp
memory/1112-55-0x00000000751A1000-0x00000000751A3000-memory.dmp
memory/1400-78-0x0000000007980000-0x0000000007B02000-memory.dmp
memory/1400-66-0x0000000004A00000-0x0000000004AC1000-memory.dmp
memory/1400-69-0x0000000006A10000-0x0000000006B00000-memory.dmp
memory/1560-59-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1560-68-0x0000000000320000-0x0000000000334000-memory.dmp
memory/1560-67-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1560-64-0x0000000000AF0000-0x0000000000DF3000-memory.dmp
memory/1560-65-0x0000000000130000-0x0000000000144000-memory.dmp
memory/1560-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1560-61-0x0000000000400000-0x000000000042F000-memory.dmp