Analysis
- max time kernel
152s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
15/04/2022, 11:18
General
- Target Skystar Co K.S.A Purchase Order.exe
- Size 79KB
- Sample220415-nd9ffabhd4
- SHA256 90e04c24a8b6d9e6fa70821c848c1ccd7ff1f1bc2c78d19c5bc2fa09838a436e
Malware Config
Extracted
-
formbook
-
4.1
-
gc5j
-
abrahamsplumbing.com
-
139.info
-
insta-plus.com
-
pflegenius.com
-
nftworks.site
-
greendil.com
-
pathegame.com
-
supplychainscenarioplanning.com
-
jnljdx.com
-
officely.xyz
-
cashoffersdirect.net
-
llmattioli.online
-
qvdautomotive.com
-
nbxinwen.com
-
amooitresses.com
-
innovapos.xyz
-
holycowspice.com
-
caspianoriginals.com
-
map-database.com
-
grac3fulallur.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Skystar Co K.S.A Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Skystar Co K.S.A Purchase Order.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 104⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Skystar Co K.S.A Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Skystar Co K.S.A Purchase Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Skystar Co K.S.A Purchase Order.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1552-130-0x0000000000D80000-0x0000000000D9A000-memory.dmp
memory/1552-131-0x0000000005DA0000-0x0000000006344000-memory.dmp
memory/1552-132-0x0000000005730000-0x00000000057C2000-memory.dmp
memory/1552-133-0x00000000057F0000-0x00000000057FA000-memory.dmp
memory/1552-134-0x00000000057F0000-0x0000000005D94000-memory.dmp
memory/2204-138-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2204-140-0x0000000001920000-0x0000000001C6A000-memory.dmp
memory/2204-141-0x0000000001CA0000-0x0000000001CB4000-memory.dmp
memory/2284-142-0x0000000002DB0000-0x0000000002E74000-memory.dmp
memory/2284-149-0x0000000007DC0000-0x0000000007EDB000-memory.dmp
memory/4504-145-0x00000000008D0000-0x00000000008D6000-memory.dmp
memory/4504-146-0x0000000000480000-0x00000000004AF000-memory.dmp
memory/4504-147-0x0000000002540000-0x000000000288A000-memory.dmp
memory/4504-148-0x0000000002280000-0x0000000002313000-memory.dmp