Analysis
- max time kernel
147s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
19/08/2022, 12:49
General
- Target PURCHASE ORDER.exe
- Size 969KB
- Sample220819-p2b1hsdear
- SHA256 8de6ed84b73447703a0ddf14eb89ffcbe4a6095e4826cf07253ca04fb38d90d6
Malware Config
Extracted
-
formbook
-
4.1
-
na8d
-
bhuytfcv.com
-
weareglobalocean.com
-
engineeredpages.com
-
coloninstitute.com
-
marksinfo.com
-
contenidoabierto.com
-
cubatonsandwichshop.com
-
resourceeminence.top
-
factbois.com
-
bookmarkfiles.info
-
jd-hmdr.com
-
locksmithpoincianafl.com
-
centralchandeliers.com
-
project17.xyz
-
arcticsoundhuskies.com
-
expatstrikesback.com
-
creatortoolchest.com
-
redbaronmarketing.com
-
shopcomputer.website
-
segocycles.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Formbook payload 6 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\System32\calc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
332logim.jpeg
332logrf.ini
332logrg.ini
332logri.ini
332logrv.ini
memory/2212-226-0x0000000008440000-0x00000000085B0000-memory.dmp
memory/2212-229-0x00000000085B0000-0x00000000086B6000-memory.dmp
memory/2212-240-0x0000000008770000-0x0000000008809000-memory.dmp
memory/2212-238-0x0000000008770000-0x0000000008809000-memory.dmp
memory/2396-182-0x0000000050410000-0x000000005043F000-memory.dmp
memory/2736-228-0x0000000002880000-0x0000000002894000-memory.dmp
memory/2736-231-0x0000000050410000-0x000000005043F000-memory.dmp
memory/2736-225-0x00000000025C0000-0x00000000025D4000-memory.dmp
memory/2736-224-0x0000000002970000-0x0000000002CBA000-memory.dmp
memory/2736-223-0x0000000050410000-0x000000005043F000-memory.dmp
memory/2924-234-0x0000000002D00000-0x000000000304A000-memory.dmp
memory/2924-232-0x0000000000C30000-0x0000000000C46000-memory.dmp
memory/2924-237-0x0000000002B40000-0x0000000002BD3000-memory.dmp
memory/2924-233-0x0000000000B50000-0x0000000000B7F000-memory.dmp
memory/2924-239-0x0000000000B50000-0x0000000000B7F000-memory.dmp