Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-20220414-en - submitted
03/05/2022, 12:33
General
- Target DHL_AWB_NO#907853880911.exe
- Size 213KB
- Sample220503-prdflaech7
- SHA256 e0586f6e028448a0dafda2bf958fd9d1d9b63636b29c8a8847e481a3122e71a2
Malware Config
Extracted
-
formbook
-
4.1
-
fw02
-
payer-breakers.com
-
thesiscoper.com
-
rental-villa.com
-
scovikinnovations.com
-
hydh33.com
-
allmyshit.rest
-
lovejaclyn.com
-
vanessaruizwriting.com
-
dufonddelaclasse.com
-
kiddee168.com
-
monumentalmarketsllc.com
-
musclegainfatloss.com
-
avida.info
-
cosmo-wellness.net
-
dandelionfusedigital.com
-
oversizeloadbanners.com
-
konstelle.store
-
sdjnsbd.com
-
czoqg.xyz
-
5p6xljjse1lq.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 4 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL_AWB_NO#907853880911.exe"C:\Users\Admin\AppData\Local\Temp\DHL_AWB_NO#907853880911.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nceystz.exeC:\Users\Admin\AppData\Local\Temp\nceystz.exe C:\Users\Admin\AppData\Local\Temp\oqkvcyrte3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nceystz.exeC:\Users\Admin\AppData\Local\Temp\nceystz.exe C:\Users\Admin\AppData\Local\Temp\oqkvcyrte4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\nceystz.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
jc417bh38wtxp
nceystz.exe
nceystz.exe
nceystz.exe
oqkvcyrte
nceystz.exe
nceystz.exe
memory/1168-79-0x0000000001C30000-0x0000000001CC3000-memory.dmp
memory/1168-78-0x0000000001E60000-0x0000000002163000-memory.dmp
memory/1168-76-0x0000000000060000-0x000000000007A000-memory.dmp
memory/1168-77-0x00000000000E0000-0x000000000010F000-memory.dmp
memory/1312-73-0x0000000006C10000-0x0000000006D97000-memory.dmp
memory/1312-70-0x00000000069C0000-0x0000000006B1B000-memory.dmp
memory/1312-80-0x0000000006DA0000-0x0000000006ED1000-memory.dmp
memory/1504-72-0x0000000000390000-0x00000000003A4000-memory.dmp
memory/1504-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1504-68-0x00000000008D0000-0x0000000000BD3000-memory.dmp
memory/1504-69-0x0000000000340000-0x0000000000354000-memory.dmp
memory/1504-67-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1692-54-0x0000000075951000-0x0000000075953000-memory.dmp