Analysis
- max time kernel
152s - max time network
148s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
09/02/2022, 15:32
General
- Target Ödeme kanıtı.exe
- Size 809KB
- Sample220209-syn3fsbaan
- SHA256 503f221f367baedb8a7c4aa592c21af73eb9bf6be4fe4a18b5588c0e9e6f9e23
Malware Config
Extracted
-
formbook
-
4.1
-
gn27
-
perilunevc.com
-
kantogaming.com
-
stageyor.online
-
jixsux.site
-
dingmei2020.icu
-
savagesupplyco.com
-
deadstockllc.com
-
leyandfey.com
-
zjn22558800.com
-
projectupskill.net
-
outliersresearch.com
-
spaced.community
-
zschengbangzx.com
-
5gxzxxtax-ety7f.biz
-
iq0xe.com
-
6388xp9xg9k.com
-
hengyungdzz.com
-
retrosale.com
-
echt.global
-
canceltotalav.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ödeme kanıtı.exe"C:\Users\Admin\AppData\Local\Temp\Ödeme kanıtı.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tDvArNEAiSxmk.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tDvArNEAiSxmk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp86BD.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/576-68-0x00000000025D1000-0x00000000025D2000-memory.dmp
memory/576-65-0x000000006EB71000-0x000000006EB72000-memory.dmp
memory/576-66-0x00000000025D0000-0x00000000025D1000-memory.dmp
memory/576-70-0x00000000025D2000-0x00000000025D4000-memory.dmp
memory/576-59-0x0000000075D61000-0x0000000075D63000-memory.dmp
memory/576-67-0x000000006EB72000-0x000000006EB74000-memory.dmp
memory/616-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/616-71-0x0000000000A20000-0x0000000000D23000-memory.dmp
memory/616-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/616-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/616-73-0x0000000000150000-0x0000000000164000-memory.dmp
memory/616-69-0x0000000000400000-0x000000000042F000-memory.dmp
memory/616-72-0x000000000041F000-0x0000000000420000-memory.dmp
memory/1412-79-0x0000000007BF0000-0x0000000007D67000-memory.dmp
memory/1412-74-0x0000000006960000-0x0000000006AAD000-memory.dmp
memory/1536-75-0x0000000000A80000-0x0000000000A85000-memory.dmp
memory/1536-76-0x00000000000D0000-0x00000000000FF000-memory.dmp
memory/1536-77-0x0000000002020000-0x0000000002323000-memory.dmp
memory/1536-78-0x00000000008E0000-0x0000000000973000-memory.dmp
memory/1740-57-0x0000000000580000-0x000000000058C000-memory.dmp
memory/1740-58-0x0000000005060000-0x0000000005100000-memory.dmp
memory/1740-55-0x00000000748DE000-0x00000000748DF000-memory.dmp
memory/1740-56-0x00000000005D0000-0x00000000005D1000-memory.dmp
memory/1740-54-0x0000000000BC0000-0x0000000000C90000-memory.dmp