Overview

overview

10

Static

static

1

Halkbank,d...10.exe

windows7_x64

10

Halkbank,d...10.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    21-04-2021 09:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Halkbank,doc 00100210210.exe

  • Size

    270KB

  • MD5

    4744495f286ed57aee218fe035b6d8b5

  • SHA1

    f90d47ed2f471017c913c6e6d5924f38d9a6673c

  • SHA256

    b03f6bc5eec0f24076b3ef2c761b21d75c489ad34c5f94dcffab6d2b4d65263f

  • SHA512

    c9b78c243895fdd30a673b045b6b2b5ca0d552490d4c0c005c583ccaa03c42d54df3a7b2e978f169dc9009ff651ea1a4eb8130a9335879c45b95d02f6153e037

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.magnumopuspro.com/nyr/

Decoy

anemone-vintage.com

ironcitytools.com

joshandmatthew.com

breathtakingscenery.photos

karabakh-terror.com

micahelgall.com

entretiendesterrasses.com

mhgholdings.com

blewm.com

sidewalknotary.com

ytrs-elec.com

danhpham.com

ma21cle2henz.xyz

lotusforlease.com

shipleyphotoandfilm.com

bulktool.xyz

ouedzmala.com

yichengvpr.com

connectmygames.com

chjcsc.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 2 IoCs
    rat
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\Halkbank,doc 00100210210.exe
      "C:\Users\Admin\AppData\Local\Temp\Halkbank,doc 00100210210.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4024
      • C:\Users\Admin\AppData\Local\Temp\Halkbank,doc 00100210210.exe
        "C:\Users\Admin\AppData\Local\Temp\Halkbank,doc 00100210210.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2380
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\SysWOW64\control.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2500
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Halkbank,doc 00100210210.exe"
        3⤵
          PID:3828

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsz1E1F.tmp\c4y3gc.dll
      MD5

      127cb178b9b88a44d8dd4c0f4d37d723

      SHA1

      eebbe7fa1f97fb99ed8b9e22b5bab8b2838c0e86

      SHA256

      b8f809ad68b284ad6039143935ffc90a3cd4c6a71a9eca77eef981e83a4c89b2

      SHA512

      b6b02bae72fc9103d35238e2380f7213038cbcb7472f55b032b963993d8b9306f97651675796e3082360b42e717ae7d4aa5694c750cf0e9b18edbb3ff94415ad

      Download Submit
    • memory/2380-115-0x000000000041EBA0-mapping.dmp
      Download
    • memory/2380-119-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

      Download
    • memory/2380-118-0x00000000004F0000-0x000000000063A000-memory.dmp
      Filesize

      1.3MB

      Download
    • memory/2380-121-0x0000000000AA0000-0x0000000000DC0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/2500-123-0x00000000002E0000-0x0000000000300000-memory.dmp
      Filesize

      128KB

      Download
    • memory/2500-127-0x0000000004430000-0x00000000044C3000-memory.dmp
      Filesize

      588KB

      Download
    • memory/2500-126-0x00000000045D0000-0x00000000048F0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/2500-122-0x0000000000000000-mapping.dmp
      Download
    • memory/2500-124-0x0000000002570000-0x000000000259E000-memory.dmp
      Filesize

      184KB

      Download
    • memory/3024-120-0x00000000063D0000-0x00000000064FA000-memory.dmp
      Filesize

      1.2MB

      Download
    • memory/3024-128-0x0000000006600000-0x0000000006713000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/3828-125-0x0000000000000000-mapping.dmp
      Download
    • memory/4024-117-0x0000000002961000-0x0000000002963000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4024-116-0x0000000002960000-0x0000000002961000-memory.dmp
      Filesize

      4KB

      Download