Analysis
- max time kernel
1801s - max time network
1786s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
14/03/2022, 14:01
Static task
static1
Behavioral task
behavioral1
Sample
DHL shipment-xlsx.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
- Target DHL shipment-xlsx.exe
- Size 338KB
- Sample220314-rbnmqsabem
- SHA256 b9531a6cb2babbc047c7bb0debb17d335b684e484e091ebcf85cb64490ed6537
- MD5 7c6c5cbacf87c1c8f49427b695c7217f
- SHA1 58d64edf133aa49598afbd8b9bdfba29349eea12
- SHA512 851e54b54681af0970604bd2a0a0d1b5f13669b511386feacad06339f598be6f06a3a2533fec5a5680e4aed1057c8e7fd09d5d73c60b6dbe12bba6a21dfa3736
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
by73
Decoy
-
advertencys.info
-
printableminis.com
-
mjahpr.icu
-
workremotehome.com
-
es-dailynews.info
-
zaryard.com
-
your-bakemark.com
-
metalypsis.com
-
primehomerealtyut.com
-
turbantechie.com
-
dd-mhgj.com
-
earnwithcryptocurrency.com
-
xn--8dbh2c.com
-
trainopia.com
-
plysec.xyz
-
avis-tente.com
-
pitabel.com
-
gabriannanails.com
-
thebipolarpenguin.com
-
alumistarcomponentes.com
-
unoevento.com
-
webceo.info
-
manukamortgages.ltd
-
tccanadapod.com
-
supersuds.info
-
brcsnow.club
-
beijing911.com
-
jinnkosolar.com
-
monanimes.com
-
depivony.space
-
webstergreenparking.com
-
sp2022.top
-
jenoediting.com
-
beautysurgepodcast.com
-
untitlednft.art
-
abmur.icu
-
albagroup.online
-
hunbrain.com
-
gmiinvestment.com
-
lumpwant.com
-
fr-kamagra.com
-
nightdate.club
-
onlineritual.com
-
shinaideba.com
-
craftsmenmasters.com
-
stock-file.com
-
queensmencocktails.com
-
megaconstructionofct.com
-
youcomway.com
-
multichannels247.com
-
pasti-lite.com
-
pokerfac.info
-
highpointquartet.com
-
smokinwaffles.com
-
ocoremioparis.com
-
decisivedevelopmentllc.com
-
diamondstormentertainment.com
-
vidacanela.com
-
hgwpoh.icu
-
eqajyxeg.space
-
easydocumentssolutions.com
-
perfect-calendar.com
-
oidepps.com
-
solastaacademy.com
-
activusrealtime.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/4416-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1788-147-0x00000000012C0000-0x00000000012EF000-memory.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HBC81N8P = "C:\\Program Files (x86)\\Vdx4tzjq8\\odftqo2x.exe" svchost.exe - Executes dropped EXE 3 IoCs
pid Process 3084 qjgnqgi.exe 4416 qjgnqgi.exe 4628 odftqo2x.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3084 set thread context of 4416 3084 qjgnqgi.exe 83 PID 4416 set thread context of 2996 4416 qjgnqgi.exe 54 PID 1788 set thread context of 2996 1788 svchost.exe 54 - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Vdx4tzjq8 Explorer.EXE File created C:\Program Files (x86)\Vdx4tzjq8\odftqo2x.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Vdx4tzjq8\odftqo2x.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Vdx4tzjq8\odftqo2x.exe svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4904 4628 WerFault.exe 97 -
description ioc Process Key created \Registry\User\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4416 qjgnqgi.exe 4416 qjgnqgi.exe 4416 qjgnqgi.exe 4416 qjgnqgi.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2996 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4416 qjgnqgi.exe 4416 qjgnqgi.exe 4416 qjgnqgi.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe 1788 svchost.exe - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 4416 qjgnqgi.exe Token: SeDebugPrivilege 1788 svchost.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2996 Explorer.EXE - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2104 wrote to memory of 3084 2104 DHL shipment-xlsx.exe 82 PID 2104 wrote to memory of 3084 2104 DHL shipment-xlsx.exe 82 PID 2104 wrote to memory of 3084 2104 DHL shipment-xlsx.exe 82 PID 3084 wrote to memory of 4416 3084 qjgnqgi.exe 83 PID 3084 wrote to memory of 4416 3084 qjgnqgi.exe 83 PID 3084 wrote to memory of 4416 3084 qjgnqgi.exe 83 PID 3084 wrote to memory of 4416 3084 qjgnqgi.exe 83 PID 3084 wrote to memory of 4416 3084 qjgnqgi.exe 83 PID 3084 wrote to memory of 4416 3084 qjgnqgi.exe 83 PID 2996 wrote to memory of 1788 2996 Explorer.EXE 84 PID 2996 wrote to memory of 1788 2996 Explorer.EXE 84 PID 2996 wrote to memory of 1788 2996 Explorer.EXE 84 PID 1788 wrote to memory of 5020 1788 svchost.exe 85 PID 1788 wrote to memory of 5020 1788 svchost.exe 85 PID 1788 wrote to memory of 5020 1788 svchost.exe 85 PID 1788 wrote to memory of 2580 1788 svchost.exe 94 PID 1788 wrote to memory of 2580 1788 svchost.exe 94 PID 1788 wrote to memory of 2580 1788 svchost.exe 94 PID 1788 wrote to memory of 4176 1788 svchost.exe 96 PID 1788 wrote to memory of 4176 1788 svchost.exe 96 PID 1788 wrote to memory of 4176 1788 svchost.exe 96 PID 2996 wrote to memory of 4628 2996 Explorer.EXE 97 PID 2996 wrote to memory of 4628 2996 Explorer.EXE 97 PID 2996 wrote to memory of 4628 2996 Explorer.EXE 97
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\DHL shipment-xlsx.exe"C:\Users\Admin\AppData\Local\Temp\DHL shipment-xlsx.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\qjgnqgi.exeC:\Users\Admin\AppData\Local\Temp\qjgnqgi.exe C:\Users\Admin\AppData\Local\Temp\uujtbp3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\qjgnqgi.exeC:\Users\Admin\AppData\Local\Temp\qjgnqgi.exe C:\Users\Admin\AppData\Local\Temp\uujtbp4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\qjgnqgi.exe"3⤵PID:5020
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:2580
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4176
-
-
-
C:\Program Files (x86)\Vdx4tzjq8\odftqo2x.exe"C:\Program Files (x86)\Vdx4tzjq8\odftqo2x.exe"2⤵
- Executes dropped EXE
PID:4628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 2323⤵
- Program crash
PID:4904
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4628 -ip 46281⤵PID:3832