Analysis
-
max time kernel
151s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 13:42
Static task
static1
Behavioral task
behavioral1
Sample
Promar Industrial Chemicals PO.exe
Resource
win7-en-20211208
General
-
Target
Promar Industrial Chemicals PO.exe
-
Size
419KB
-
MD5
c368451b88a7831a71d9f9e9cbdf6ce5
-
SHA1
dfd8f1ef334550cd94763e0bc60b5b4f243f3ebd
-
SHA256
2d982a64999857ad75996e06f4a858c43b1bd5e17422195414de62d5e344e413
-
SHA512
52c9208cad6f6ff477b4013d32e3b5f15a8e71d4b33dcc8825c21d7c5d0ef00dcbd9b805865340d57688fcd51726ddc5b0b74b6167c0586c7e0e7a6192fe1d17
Malware Config
Extracted
formbook
4.1
n2t4
livingthroughthechaos.net
videobuzzmedia.com
felineformulas.com
theorganicbees.com
bizoeflow.com
gtbcked.com
immortalapenft.com
pacherasrl.com
defunddrip.black
fromefarm.com
newmedicalnetwork.com
nikosblue.com
kaecfu.online
arcane-stylish.com
7ox.info
osamaabuzawayed.com
noemielatour.com
baccaratjava.com
latinfoodandwinefestival.com
magiclandstudios.com
shazpe.com
businessmanbazar.com
lifewithkatiewright.com
themarketingideascatalog.com
nickbrizhoops.com
esportsgamertv.com
delinointeriores.com
connotatetechnologies.net
cybomatic.cloud
correctmakling.site
thammydora.com
ageingwellhomecare.com
fleetwoodjobshop.site
jakulo.com
drbaren.com
newpointstudio.com
yxuqamnj.com
spiritsyncing.net
hy963app.com
rnp-trading-lukoil.com
bowlesuniverse.com
fumigacionesecouniversal.com
vulvip.com
heppi.pro
preetiplease.com
gemini-hk.icu
allyazek24.xyz
blackbratapparelcompany.com
immersivenm.com
mystoragewarehouse.com
dvjdob.icu
mecanicadesuelosrancagua.one
cayugacommunitysolar.com
parizes.site
vpsincnas.com
tattoo-marketplace.online
garadapatngklgamazon.com
signa.info
simplegourmetpa.com
quintanaroopt.com
studio-goettingen.com
brimhi.com
fabula-glass.com
1049hubertrd.com
faireez.club
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1456-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1536-70-0x0000000000070000-0x000000000009F000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 856 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Promar Industrial Chemicals PO.exePromar Industrial Chemicals PO.execscript.exedescription pid process target process PID 948 set thread context of 1456 948 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 1456 set thread context of 1400 1456 Promar Industrial Chemicals PO.exe Explorer.EXE PID 1536 set thread context of 1400 1536 cscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
Promar Industrial Chemicals PO.execscript.exepowershell.exepid process 1456 Promar Industrial Chemicals PO.exe 1456 Promar Industrial Chemicals PO.exe 1536 cscript.exe 1536 cscript.exe 1396 powershell.exe 1536 cscript.exe 1536 cscript.exe 1536 cscript.exe 1536 cscript.exe 1536 cscript.exe 1536 cscript.exe 1536 cscript.exe 1536 cscript.exe 1536 cscript.exe 1536 cscript.exe 1536 cscript.exe 1536 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Promar Industrial Chemicals PO.execscript.exepid process 1456 Promar Industrial Chemicals PO.exe 1456 Promar Industrial Chemicals PO.exe 1456 Promar Industrial Chemicals PO.exe 1536 cscript.exe 1536 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Promar Industrial Chemicals PO.execscript.exepowershell.exedescription pid process Token: SeDebugPrivilege 1456 Promar Industrial Chemicals PO.exe Token: SeDebugPrivilege 1536 cscript.exe Token: SeDebugPrivilege 1396 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Promar Industrial Chemicals PO.exeExplorer.EXEcscript.exedescription pid process target process PID 948 wrote to memory of 1396 948 Promar Industrial Chemicals PO.exe powershell.exe PID 948 wrote to memory of 1396 948 Promar Industrial Chemicals PO.exe powershell.exe PID 948 wrote to memory of 1396 948 Promar Industrial Chemicals PO.exe powershell.exe PID 948 wrote to memory of 1396 948 Promar Industrial Chemicals PO.exe powershell.exe PID 948 wrote to memory of 1072 948 Promar Industrial Chemicals PO.exe schtasks.exe PID 948 wrote to memory of 1072 948 Promar Industrial Chemicals PO.exe schtasks.exe PID 948 wrote to memory of 1072 948 Promar Industrial Chemicals PO.exe schtasks.exe PID 948 wrote to memory of 1072 948 Promar Industrial Chemicals PO.exe schtasks.exe PID 948 wrote to memory of 1456 948 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 948 wrote to memory of 1456 948 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 948 wrote to memory of 1456 948 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 948 wrote to memory of 1456 948 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 948 wrote to memory of 1456 948 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 948 wrote to memory of 1456 948 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 948 wrote to memory of 1456 948 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 1400 wrote to memory of 1536 1400 Explorer.EXE cscript.exe PID 1400 wrote to memory of 1536 1400 Explorer.EXE cscript.exe PID 1400 wrote to memory of 1536 1400 Explorer.EXE cscript.exe PID 1400 wrote to memory of 1536 1400 Explorer.EXE cscript.exe PID 1536 wrote to memory of 856 1536 cscript.exe cmd.exe PID 1536 wrote to memory of 856 1536 cscript.exe cmd.exe PID 1536 wrote to memory of 856 1536 cscript.exe cmd.exe PID 1536 wrote to memory of 856 1536 cscript.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Promar Industrial Chemicals PO.exe"C:\Users\Admin\AppData\Local\Temp\Promar Industrial Chemicals PO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LOJZtdXKgVLc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LOJZtdXKgVLc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp22CC.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Promar Industrial Chemicals PO.exe"C:\Users\Admin\AppData\Local\Temp\Promar Industrial Chemicals PO.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Promar Industrial Chemicals PO.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp22CC.tmpMD5
5b5694b336e5b030ca7b92910bb85e91
SHA14fccdc48db8be78e33df17bb0e1b2ea96a96977c
SHA25630f3208e29c992c772683c98a90ede5133e7fcd04b2bf31b7cbc9f003b2071c5
SHA512bd658c97778b6ab1336cd86e8efbfc55c1f32ad7fe0ee8d8009260cf6ce394c80cf90ebcb316d9938a3b9e61def1b2ccf38873558d476570b698a122ed0542e8
-
memory/948-56-0x0000000076B81000-0x0000000076B83000-memory.dmpFilesize
8KB
-
memory/948-57-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/948-58-0x00000000005A0000-0x00000000005AC000-memory.dmpFilesize
48KB
-
memory/948-59-0x00000000052E0000-0x000000000534A000-memory.dmpFilesize
424KB
-
memory/948-55-0x00000000008D0000-0x0000000000940000-memory.dmpFilesize
448KB
-
memory/1396-73-0x00000000022A0000-0x0000000002EEA000-memory.dmpFilesize
12.3MB
-
memory/1396-72-0x00000000022A0000-0x0000000002EEA000-memory.dmpFilesize
12.3MB
-
memory/1400-68-0x00000000071E0000-0x0000000007303000-memory.dmpFilesize
1.1MB
-
memory/1400-75-0x0000000004C10000-0x0000000004CF8000-memory.dmpFilesize
928KB
-
memory/1456-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1456-67-0x0000000000290000-0x00000000002A5000-memory.dmpFilesize
84KB
-
memory/1456-66-0x0000000000940000-0x0000000000C43000-memory.dmpFilesize
3.0MB
-
memory/1456-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1456-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1536-69-0x0000000000620000-0x0000000000642000-memory.dmpFilesize
136KB
-
memory/1536-70-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/1536-71-0x0000000002040000-0x0000000002343000-memory.dmpFilesize
3.0MB
-
memory/1536-74-0x0000000001F70000-0x0000000002004000-memory.dmpFilesize
592KB