Analysis

  • max time kernel
    151s
  • max time network
    12s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    15-01-2021 07:17

General

  • Target

    Mitsubishi Japan XN501.exe

  • Size

    959KB

  • MD5

    420a7a5ed66a75a7ede35f63cab3ab9c

  • SHA1

    474b0ef1e7dab85ebd7296c408de13a18afd3870

  • SHA256

    75f2a2a20e73b7e0c53d499b883a403c2b8cfbf17c5923d58e0167daa4c019c1

  • SHA512

    cafe8be480487d71115512894798775d3eb4e3219f3e0d5395d5c6a098d51515fb85a1224c12ce22d0fb8bacc612d48fdc417fe077d4bfbbf35fd7f53c47df20

Malware Config

Extracted

Family

formbook

C2

http://www.9dgevjb.net/gtl/

Decoy

45687g.net

graveimport.com

bulldogsgear.com

service-support.email

uhzcflg.icu

zebradefensefund.com

make10xhappen.com

ecotegral.online

stillatwink.site

onwardatlanta.com

real-optionstheory.com

madbearcustomwoodworking.com

adelinekaczmarek.com

elia-lca.com

tinykreations.com

rawlinsrealty.info

ubcholdings.com

searko.com

lepinedoree.com

fundsrecoveryexperts.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe
      "C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe
        "{path}"
        3⤵
          PID:1556
        • C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe
          "{path}"
          3⤵
            PID:1440
          • C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe
            "{path}"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:1192
        • C:\Windows\SysWOW64\wininit.exe
          "C:\Windows\SysWOW64\wininit.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:476
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\Mitsubishi Japan XN501.exe"
            3⤵
            • Deletes itself
            PID:280

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/280-11-0x0000000000000000-mapping.dmp

      • memory/476-9-0x0000000000000000-mapping.dmp

      • memory/476-10-0x00000000001E0000-0x00000000001FA000-memory.dmp

        Filesize

        104KB

      • memory/476-12-0x0000000001EE0000-0x0000000001FCA000-memory.dmp

        Filesize

        936KB

      • memory/1192-7-0x0000000000400000-0x000000000042E000-memory.dmp

        Filesize

        184KB

      • memory/1192-8-0x000000000041EAF0-mapping.dmp

      • memory/1204-2-0x0000000074090000-0x000000007477E000-memory.dmp

        Filesize

        6.9MB

      • memory/1204-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

        Filesize

        4KB

      • memory/1204-5-0x0000000000310000-0x000000000031E000-memory.dmp

        Filesize

        56KB

      • memory/1204-6-0x00000000021C0000-0x000000000220C000-memory.dmp

        Filesize

        304KB