Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    97s
  • max time network
    55s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    06/07/2021, 10:03

General

  • Target

    1b415a56616a9f7c2e37fc2ce570664f.exe

  • Size

    884KB

  • MD5

    1b415a56616a9f7c2e37fc2ce570664f

  • SHA1

    2e7a5b8378e9a0e5fd7f5a8321af4d128ef2a1a3

  • SHA256

    14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd

  • SHA512

    e77e25ffeae630cc2413fd969462a7fd019738f2981b4304ab6ba4cc5bb9530db3f1210c5cb90665529f6c25c03f6a63362362a18e6bb801edeccc979a0f711b

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.lifeafterbobby.com/vn3b/

Decoy

rowenglobal.com

abrirumaempresa.com

videosbet.xyz

blackbettyxt.com

trust-red.net

sonyalpharunors.com

shiqichaoji.com

allex-ru.com

totalpowerpc.store

ptocom.com

quantumsai.club

toughcookie.love

nivafitness.com

bioskopmovie21.com

giatsaygiare.com

xiongmaojingxuan.com

zjjly88.com

trampmotorsports.com

pibblekibble.com

mymounntnittanyhealth.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b415a56616a9f7c2e37fc2ce570664f.exe
    "C:\Users\Admin\AppData\Local\Temp\1b415a56616a9f7c2e37fc2ce570664f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Users\Admin\AppData\Local\Temp\1b415a56616a9f7c2e37fc2ce570664f.exe
      "C:\Users\Admin\AppData\Local\Temp\1b415a56616a9f7c2e37fc2ce570664f.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/860-66-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/860-69-0x0000000000810000-0x0000000000B13000-memory.dmp

    Filesize

    3.0MB

  • memory/1064-60-0x0000000001020000-0x0000000001021000-memory.dmp

    Filesize

    4KB

  • memory/1064-62-0x0000000004D60000-0x0000000004D61000-memory.dmp

    Filesize

    4KB

  • memory/1064-63-0x0000000000380000-0x000000000038F000-memory.dmp

    Filesize

    60KB

  • memory/1064-64-0x0000000005AB0000-0x0000000005B2A000-memory.dmp

    Filesize

    488KB

  • memory/1064-65-0x0000000005B30000-0x0000000005B71000-memory.dmp

    Filesize

    260KB