Analysis
- max time kernel
148s - max time network
139s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
27/10/2021, 04:04
General
- Target P-Order #102721.exe
- Size 522KB
- Sample211027-emykvsafa4
- SHA256 e4f478b7cd658cb31bc1192e16ccc1509d552a7229a92fea1a3c6224ee7591a1
Malware Config
Extracted
-
formbook
-
4.1
-
cr35
-
http://www.tllyou.com/cr35/
-
tahirsoemantrigroup.com
-
hashtagstartup.net
-
guron.biz
-
donwalin.com
-
aslanrefinedhomes.com
-
quitrobo.com
-
transcriptionservicesindia.com
-
mooremedications.com
-
mahounoniwa.com
-
lowpricepath.com
-
xinmanxin.com
-
maliya-interiors.com
-
rkprops.com
-
functionsandfoundations.com
-
thelenditudenews.com
-
streetlogic.biz
-
itaste.xyz
-
protokolavukatlik.com
-
reformasmende.com
-
noahsicecream.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 5 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\P-Order #102721.exe"C:\Users\Admin\AppData\Local\Temp\P-Order #102721.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\P-Order #102721.exe"C:\Users\Admin\AppData\Local\Temp\P-Order #102721.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\P-Order #102721.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2292-115-0x0000000000370000-0x0000000000371000-memory.dmp
memory/2292-117-0x0000000005100000-0x0000000005101000-memory.dmp
memory/2292-118-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
memory/2292-119-0x0000000004C00000-0x00000000050FE000-memory.dmp
memory/2292-120-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/2292-121-0x0000000007060000-0x0000000007066000-memory.dmp
memory/2292-122-0x0000000007390000-0x0000000007391000-memory.dmp
memory/2292-123-0x0000000007530000-0x0000000007580000-memory.dmp
memory/2976-134-0x0000000000020000-0x0000000000021000-memory.dmp
memory/2976-137-0x00000000028F0000-0x000000000291F000-memory.dmp
memory/2976-140-0x0000000004180000-0x0000000004213000-memory.dmp
memory/2976-139-0x00000000042F0000-0x0000000004610000-memory.dmp
memory/2976-136-0x0000000000340000-0x0000000000352000-memory.dmp
memory/2976-135-0x0000000000020000-0x0000000000021000-memory.dmp
memory/3032-132-0x0000000006A90000-0x0000000006BB0000-memory.dmp
memory/3032-129-0x0000000006950000-0x0000000006A88000-memory.dmp
memory/3032-141-0x0000000006BB0000-0x0000000006CB2000-memory.dmp
memory/3600-131-0x00000000014D0000-0x00000000014E4000-memory.dmp
memory/3600-127-0x0000000001510000-0x0000000001830000-memory.dmp
memory/3600-130-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3600-124-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3600-128-0x0000000000F00000-0x0000000000FAE000-memory.dmp