Overview

overview

10

Static

static

H4A2-423-E...02.exe

windows7_x64

10

H4A2-423-E...02.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    07/11/2020, 09:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    H4A2-423-EM154-302.exe
  • Size 938KB
  • Sample201107-pksd2f3fye
  • SHA256 0ad4a6955fcec7e4768aa5169ad291e3e554e074313bde3ee6c266cddfa2d890
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.gmigroups.com/dn87/

Decoy

  • yiyuge.club

  • sdzrwoe.icu

  • divifarsi.com

  • sunsal.net

  • animeziyan.com

  • onlinemastersdegree.site

  • medknizhka.info

  • lowlife.one

  • livingroomexercise.com

  • themantrini.com

  • starconverters.com

  • kyssclothing.com

  • sa18i.art

  • smartdaymall.com

  • ohyeahblog.net

  • losriosnosunen.com

  • joannamarshwriter.com

  • restlanekysseoffer.com

  • oonabody.com

  • azarksigningagent.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 3 IoCs
    rat
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\H4A2-423-EM154-302.exe
      "C:\Users\Admin\AppData\Local\Temp\H4A2-423-EM154-302.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Users\Admin\AppData\Local\Temp\H4A2-423-EM154-302.exe
        "C:\Users\Admin\AppData\Local\Temp\H4A2-423-EM154-302.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3656
    • C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\SysWOW64\chkdsk.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3480
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\H4A2-423-EM154-302.exe"
        3⤵
          PID:944

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/948-0-0x0000000000400000-0x00000000004F0000-memory.dmp
          Download

          memory/3480-4-0x0000000000910000-0x000000000091A000-memory.dmp
          Download

          memory/3480-5-0x0000000000910000-0x000000000091A000-memory.dmp
          Download

          memory/3480-7-0x00000000066F0000-0x0000000006812000-memory.dmp
          Download

          memory/3656-1-0x0000000000400000-0x0000000000428000-memory.dmp
          Download