Analysis
- max time kernel
148s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
03/01/2022, 13:37
General
- Target 210325 KN ORDER CONF.exe
- Size 590KB
- Sample220103-qws8aabdc3
- SHA256 2ed8aeaf73ee1a3caf7eb0be7814868c4100efbe1b021e2d964db3b638dc7f3c
Malware Config
Extracted
-
formbook
-
4.1
-
gd02
-
sinofuturo.com
-
laboratoriosflores.com
-
taximiddelburg.com
-
e-licpresisi.com
-
xn--2e0br55e.com
-
morethenskindeep.com
-
ksptool.com
-
mymc168.xyz
-
concretecontractorbishopca.com
-
massageway.website
-
timtam-tech.xyz
-
iyaan.xyz
-
lymphasleep.com
-
nuvepazar.com
-
gratersleepacousticbird.xyz
-
videopromotiefilm.com
-
virtualnftauctions.com
-
wagnervasenate.com
-
251kings.com
-
mysparadise.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 4 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\210325 KN ORDER CONF.exe"C:\Users\Admin\AppData\Local\Temp\210325 KN ORDER CONF.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\210325 KN ORDER CONF.exe"C:\Users\Admin\AppData\Local\Temp\210325 KN ORDER CONF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\210325 KN ORDER CONF.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/396-121-0x0000000000AA0000-0x0000000000BCB000-memory.dmp
memory/396-131-0x0000000002800000-0x00000000028AD000-memory.dmp
memory/396-124-0x0000000004F60000-0x00000000050EB000-memory.dmp
memory/592-127-0x0000000000E00000-0x0000000000E06000-memory.dmp
memory/592-128-0x0000000002EE0000-0x0000000002F0F000-memory.dmp
memory/592-129-0x0000000004F80000-0x00000000052A0000-memory.dmp
memory/592-130-0x0000000004E80000-0x0000000004F14000-memory.dmp
memory/2916-120-0x00000000006E0000-0x00000000006F5000-memory.dmp
memory/2916-122-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2916-123-0x0000000000720000-0x0000000000735000-memory.dmp
memory/2916-119-0x0000000000A50000-0x0000000000D70000-memory.dmp
memory/2916-116-0x0000000000400000-0x000000000042F000-memory.dmp