Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 13:42
Static task
static1
Behavioral task
behavioral1
Sample
Promar Industrial Chemicals PO.exe
Resource
win7-en-20211208
General
-
Target
Promar Industrial Chemicals PO.exe
-
Size
419KB
-
MD5
c368451b88a7831a71d9f9e9cbdf6ce5
-
SHA1
dfd8f1ef334550cd94763e0bc60b5b4f243f3ebd
-
SHA256
2d982a64999857ad75996e06f4a858c43b1bd5e17422195414de62d5e344e413
-
SHA512
52c9208cad6f6ff477b4013d32e3b5f15a8e71d4b33dcc8825c21d7c5d0ef00dcbd9b805865340d57688fcd51726ddc5b0b74b6167c0586c7e0e7a6192fe1d17
Malware Config
Extracted
formbook
4.1
n2t4
livingthroughthechaos.net
videobuzzmedia.com
felineformulas.com
theorganicbees.com
bizoeflow.com
gtbcked.com
immortalapenft.com
pacherasrl.com
defunddrip.black
fromefarm.com
newmedicalnetwork.com
nikosblue.com
kaecfu.online
arcane-stylish.com
7ox.info
osamaabuzawayed.com
noemielatour.com
baccaratjava.com
latinfoodandwinefestival.com
magiclandstudios.com
shazpe.com
businessmanbazar.com
lifewithkatiewright.com
themarketingideascatalog.com
nickbrizhoops.com
esportsgamertv.com
delinointeriores.com
connotatetechnologies.net
cybomatic.cloud
correctmakling.site
thammydora.com
ageingwellhomecare.com
fleetwoodjobshop.site
jakulo.com
drbaren.com
newpointstudio.com
yxuqamnj.com
spiritsyncing.net
hy963app.com
rnp-trading-lukoil.com
bowlesuniverse.com
fumigacionesecouniversal.com
vulvip.com
heppi.pro
preetiplease.com
gemini-hk.icu
allyazek24.xyz
blackbratapparelcompany.com
immersivenm.com
mystoragewarehouse.com
dvjdob.icu
mecanicadesuelosrancagua.one
cayugacommunitysolar.com
parizes.site
vpsincnas.com
tattoo-marketplace.online
garadapatngklgamazon.com
signa.info
simplegourmetpa.com
quintanaroopt.com
studio-goettingen.com
brimhi.com
fabula-glass.com
1049hubertrd.com
faireez.club
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2080-127-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3592-143-0x0000000000C20000-0x0000000000C4F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Promar Industrial Chemicals PO.exePromar Industrial Chemicals PO.execolorcpl.exedescription pid process target process PID 2464 set thread context of 2080 2464 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 2080 set thread context of 3024 2080 Promar Industrial Chemicals PO.exe Explorer.EXE PID 3592 set thread context of 3024 3592 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
powershell.exePromar Industrial Chemicals PO.execolorcpl.exepid process 4044 powershell.exe 2080 Promar Industrial Chemicals PO.exe 2080 Promar Industrial Chemicals PO.exe 2080 Promar Industrial Chemicals PO.exe 2080 Promar Industrial Chemicals PO.exe 4044 powershell.exe 3592 colorcpl.exe 3592 colorcpl.exe 4044 powershell.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe 3592 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Promar Industrial Chemicals PO.execolorcpl.exepid process 2080 Promar Industrial Chemicals PO.exe 2080 Promar Industrial Chemicals PO.exe 2080 Promar Industrial Chemicals PO.exe 3592 colorcpl.exe 3592 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exePromar Industrial Chemicals PO.execolorcpl.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4044 powershell.exe Token: SeDebugPrivilege 2080 Promar Industrial Chemicals PO.exe Token: SeDebugPrivilege 3592 colorcpl.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Promar Industrial Chemicals PO.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 2464 wrote to memory of 4044 2464 Promar Industrial Chemicals PO.exe powershell.exe PID 2464 wrote to memory of 4044 2464 Promar Industrial Chemicals PO.exe powershell.exe PID 2464 wrote to memory of 4044 2464 Promar Industrial Chemicals PO.exe powershell.exe PID 2464 wrote to memory of 856 2464 Promar Industrial Chemicals PO.exe schtasks.exe PID 2464 wrote to memory of 856 2464 Promar Industrial Chemicals PO.exe schtasks.exe PID 2464 wrote to memory of 856 2464 Promar Industrial Chemicals PO.exe schtasks.exe PID 2464 wrote to memory of 2080 2464 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 2464 wrote to memory of 2080 2464 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 2464 wrote to memory of 2080 2464 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 2464 wrote to memory of 2080 2464 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 2464 wrote to memory of 2080 2464 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 2464 wrote to memory of 2080 2464 Promar Industrial Chemicals PO.exe Promar Industrial Chemicals PO.exe PID 3024 wrote to memory of 3592 3024 Explorer.EXE colorcpl.exe PID 3024 wrote to memory of 3592 3024 Explorer.EXE colorcpl.exe PID 3024 wrote to memory of 3592 3024 Explorer.EXE colorcpl.exe PID 3592 wrote to memory of 1452 3592 colorcpl.exe cmd.exe PID 3592 wrote to memory of 1452 3592 colorcpl.exe cmd.exe PID 3592 wrote to memory of 1452 3592 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Promar Industrial Chemicals PO.exe"C:\Users\Admin\AppData\Local\Temp\Promar Industrial Chemicals PO.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LOJZtdXKgVLc.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LOJZtdXKgVLc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC6D6.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Promar Industrial Chemicals PO.exe"C:\Users\Admin\AppData\Local\Temp\Promar Industrial Chemicals PO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Promar Industrial Chemicals PO.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC6D6.tmpMD5
b44d2fa76e53c32785c46f73c7f2243d
SHA10cc6d385087bec106270cfcf90d777871dc4ccf3
SHA256f7900323e3923943172c06955389dba68b2bb3a00799d88a84565c04dc3c9904
SHA5129a454b8e4c35e8b570b54d1d39b815a152a5e6402a60ec08e834187fa3fb03dcfe27dcdcef393c751c62e98a8d337f18f560419df326325e99b1efd9b9ae319c
-
memory/2080-136-0x0000000001690000-0x00000000019B0000-memory.dmpFilesize
3.1MB
-
memory/2080-137-0x00000000014F0000-0x0000000001681000-memory.dmpFilesize
1.6MB
-
memory/2080-127-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2464-119-0x00000000057C0000-0x0000000005CBE000-memory.dmpFilesize
5.0MB
-
memory/2464-116-0x0000000005CC0000-0x00000000061BE000-memory.dmpFilesize
5.0MB
-
memory/2464-121-0x0000000007EE0000-0x0000000007F7C000-memory.dmpFilesize
624KB
-
memory/2464-122-0x0000000008170000-0x00000000081DA000-memory.dmpFilesize
424KB
-
memory/2464-118-0x0000000005760000-0x000000000576A000-memory.dmpFilesize
40KB
-
memory/2464-115-0x0000000000ED0000-0x0000000000F40000-memory.dmpFilesize
448KB
-
memory/2464-117-0x00000000057C0000-0x0000000005852000-memory.dmpFilesize
584KB
-
memory/2464-120-0x00000000059A0000-0x00000000059AC000-memory.dmpFilesize
48KB
-
memory/3024-239-0x0000000005660000-0x000000000579A000-memory.dmpFilesize
1.2MB
-
memory/3024-138-0x0000000006510000-0x000000000666A000-memory.dmpFilesize
1.4MB
-
memory/3592-144-0x0000000004B90000-0x0000000004EB0000-memory.dmpFilesize
3.1MB
-
memory/3592-143-0x0000000000C20000-0x0000000000C4F000-memory.dmpFilesize
188KB
-
memory/3592-142-0x0000000000E30000-0x0000000000E49000-memory.dmpFilesize
100KB
-
memory/3592-237-0x00000000049F0000-0x0000000004B89000-memory.dmpFilesize
1.6MB
-
memory/4044-126-0x0000000000E00000-0x0000000000E36000-memory.dmpFilesize
216KB
-
memory/4044-153-0x0000000008E80000-0x0000000008EB3000-memory.dmpFilesize
204KB
-
memory/4044-133-0x0000000006CE0000-0x0000000006D46000-memory.dmpFilesize
408KB
-
memory/4044-139-0x0000000006920000-0x000000000693C000-memory.dmpFilesize
112KB
-
memory/4044-140-0x0000000007B10000-0x0000000007B5B000-memory.dmpFilesize
300KB
-
memory/4044-141-0x0000000007DD0000-0x0000000007E46000-memory.dmpFilesize
472KB
-
memory/4044-129-0x0000000006770000-0x0000000006771000-memory.dmpFilesize
4KB
-
memory/4044-132-0x0000000006C70000-0x0000000006CD6000-memory.dmpFilesize
408KB
-
memory/4044-131-0x0000000006772000-0x0000000006773000-memory.dmpFilesize
4KB
-
memory/4044-134-0x00000000076C0000-0x0000000007A10000-memory.dmpFilesize
3.3MB
-
memory/4044-154-0x0000000008BA0000-0x0000000008BBE000-memory.dmpFilesize
120KB
-
memory/4044-159-0x0000000008FB0000-0x0000000009055000-memory.dmpFilesize
660KB
-
memory/4044-160-0x0000000009130000-0x00000000091C4000-memory.dmpFilesize
592KB
-
memory/4044-230-0x0000000006773000-0x0000000006774000-memory.dmpFilesize
4KB
-
memory/4044-229-0x000000007E6A0000-0x000000007E6A1000-memory.dmpFilesize
4KB
-
memory/4044-130-0x0000000006AD0000-0x0000000006AF2000-memory.dmpFilesize
136KB
-
memory/4044-128-0x0000000006DB0000-0x00000000073D8000-memory.dmpFilesize
6.2MB
-
memory/4044-357-0x0000000008B60000-0x0000000008B7A000-memory.dmpFilesize
104KB
-
memory/4044-362-0x0000000008B50000-0x0000000008B58000-memory.dmpFilesize
32KB