Analysis

  • max time kernel
    108s
  • max time network
    9s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    05-05-2021 05:44

General

  • Target

    SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe

  • Size

    2.4MB

  • MD5

    6da8e0e9d3f4d31afc310050825cea27

  • SHA1

    47512cec2a0608c17b01e9fdf40776ec99743cf0

  • SHA256

    9c9dfbf8c44bbe594498ebf93efd84fcf73d66d9c6d5b86e9979afe5e9e9330c

  • SHA512

    bb45fadb068eb2e2aaec99c609ebd3256ac038a506a548085d24191d1d9a993d627c0791e190aef561344bcb1897511e90f4bac96707e5099d07ec218af8871b

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.intelliedgeclinical.net/god/

Decoy

aprendiz.digital

baby-rosy.com

buzzstreetnews.com

restoredscore.com

fullbeingphysician.com

gameonaustralia.com

famdns.com

compassionatecare-llc.com

yureb.com

bike-abruzzo.com

hibiskuricity.site

hindusetu.com

searchingkitsapcountyhomes.com

trespal.com

forenvid.com

gangnamstationithacany.com

roshan-prime.com

fsmstudio.com

bilecikvinckiralama.com

cash4urhousekeys.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/868-67-0x000000000041EBD0-mapping.dmp
  • memory/868-66-0x0000000000400000-0x000000000042E000-memory.dmp
    Filesize

    184KB

  • memory/868-69-0x0000000000860000-0x0000000000B63000-memory.dmp
    Filesize

    3.0MB

  • memory/1200-60-0x0000000000B80000-0x0000000000B81000-memory.dmp
    Filesize

    4KB

  • memory/1200-62-0x0000000000590000-0x000000000059E000-memory.dmp
    Filesize

    56KB

  • memory/1200-63-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
    Filesize

    4KB

  • memory/1200-64-0x00000000051F0000-0x000000000526E000-memory.dmp
    Filesize

    504KB

  • memory/1200-65-0x00000000043D0000-0x0000000004405000-memory.dmp
    Filesize

    212KB