Analysis
- max time kernel
146s - max time network
140s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
03/01/2022, 13:37
General
- Target 210325 KN ORDER CONF.exe
- Size 590KB
- Sample220103-qws8aabdc3
- SHA256 2ed8aeaf73ee1a3caf7eb0be7814868c4100efbe1b021e2d964db3b638dc7f3c
Malware Config
Extracted
-
formbook
-
4.1
-
gd02
-
sinofuturo.com
-
laboratoriosflores.com
-
taximiddelburg.com
-
e-licpresisi.com
-
xn--2e0br55e.com
-
morethenskindeep.com
-
ksptool.com
-
mymc168.xyz
-
concretecontractorbishopca.com
-
massageway.website
-
timtam-tech.xyz
-
iyaan.xyz
-
lymphasleep.com
-
nuvepazar.com
-
gratersleepacousticbird.xyz
-
videopromotiefilm.com
-
virtualnftauctions.com
-
wagnervasenate.com
-
251kings.com
-
mysparadise.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 3 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\210325 KN ORDER CONF.exe"C:\Users\Admin\AppData\Local\Temp\210325 KN ORDER CONF.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\210325 KN ORDER CONF.exe"C:\Users\Admin\AppData\Local\Temp\210325 KN ORDER CONF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\210325 KN ORDER CONF.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/656-60-0x00000000002C0000-0x00000000002D5000-memory.dmp
memory/656-56-0x0000000000400000-0x000000000042F000-memory.dmp
memory/656-59-0x0000000000810000-0x0000000000B13000-memory.dmp
memory/1208-61-0x00000000060A0000-0x00000000061D9000-memory.dmp
memory/1208-68-0x0000000006280000-0x0000000006374000-memory.dmp
memory/1548-63-0x00000000006F0000-0x00000000006F8000-memory.dmp
memory/1548-64-0x00000000000C0000-0x00000000000EF000-memory.dmp
memory/1548-66-0x00000000009D0000-0x0000000000CD3000-memory.dmp
memory/1548-67-0x0000000000700000-0x0000000000794000-memory.dmp
memory/1720-54-0x0000000076151000-0x0000000076153000-memory.dmp