Analysis
- max time kernel
146s - max time network
141s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
24/10/2022, 12:26
General
- Target DHL shipment tax invoice DHAIR00233210 2022 10 23.exe
- Size 810KB
- Sample221024-pl7ggsgfep
- SHA256 1edc58836efa9d62f0257732fd5729bb5b36df6312aca2f29d12dce0731a0c2b
Malware Config
Extracted
-
formbook
-
4.1
-
jr22
-
941zhe.com
-
lunarportal.space
-
xn--osmaniyeiek-t9ab.online
-
trejoscar.com
-
nrnursery.com
-
quizcannot.cfd
-
seedstockersthailand.com
-
watsonwindow.com
-
wjfholdings.com
-
weziclondon.com
-
naruot.xyz
-
yeji.plus
-
classicmenstore.com
-
oharatravel.com
-
therapyplankits.com
-
keviegreshonpt.com
-
qdlyner.com
-
seithupaarungal.com
-
casinorates.online
-
8ug4as.icu
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 5 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL shipment tax invoice DHAIR00233210 2022 10 23.exe"C:\Users\Admin\AppData\Local\Temp\DHL shipment tax invoice DHAIR00233210 2022 10 23.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL shipment tax invoice DHAIR00233210 2022 10 23.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\DHL shipment tax invoice DHAIR00233210 2022 10 23.exe"C:\Users\Admin\AppData\Local\Temp\DHL shipment tax invoice DHAIR00233210 2022 10 23.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL shipment tax invoice DHAIR00233210 2022 10 23.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/944-82-0x0000000000090000-0x00000000000BF000-memory.dmp
memory/944-80-0x0000000000970000-0x0000000000A03000-memory.dmp
memory/944-78-0x0000000001EE0000-0x00000000021E3000-memory.dmp
memory/944-77-0x0000000000090000-0x00000000000BF000-memory.dmp
memory/944-76-0x0000000000AC0000-0x0000000000AD8000-memory.dmp
memory/1200-71-0x0000000004AC0000-0x0000000004B93000-memory.dmp
memory/1200-83-0x0000000004BA0000-0x0000000004CFD000-memory.dmp
memory/1200-81-0x0000000004BA0000-0x0000000004CFD000-memory.dmp
memory/1512-60-0x0000000004990000-0x00000000049C4000-memory.dmp
memory/1512-54-0x0000000000280000-0x0000000000350000-memory.dmp
memory/1512-55-0x00000000756A1000-0x00000000756A3000-memory.dmp
memory/1512-56-0x0000000000500000-0x0000000000516000-memory.dmp
memory/1512-57-0x0000000000520000-0x000000000052C000-memory.dmp
memory/1512-58-0x0000000004A70000-0x0000000004AE0000-memory.dmp
memory/1692-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1692-68-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1692-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1692-64-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1692-70-0x0000000000350000-0x0000000000364000-memory.dmp
memory/1692-69-0x0000000000AA0000-0x0000000000DA3000-memory.dmp
memory/1704-79-0x00000000741E0000-0x000000007478B000-memory.dmp
memory/1704-72-0x00000000741E0000-0x000000007478B000-memory.dmp