Analysis

  • max time kernel
    123s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    21-07-2021 18:05

General

  • Target

    6a0200a4316e595561f8527e3bcf27bc.exe

  • Size

    925KB

  • MD5

    6a0200a4316e595561f8527e3bcf27bc

  • SHA1

    4c356c914ccdf83b8c89b6a02a2c4a9391094763

  • SHA256

    f8f02165547227a6692d503cf1203dcaf2d43b58219bb78cb0e42895f49a8121

  • SHA512

    af3decd9eaf59e31462fce7cdf36335814151c6c512aa0248d0877c7addbfeccdb530f01a11de1fc47b6d8f5bd1dc506175d9c0d4fd67376cd06da5e89b90470

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.hometowncashbuyersgroup.com/kkt/

Decoy

inspirafutebol.com

customgiftshouston.com

mycreativelending.com

psplaystore.com

newlivingsolutionshop.com

dechefamsterdam.com

servicingl0ans.com

atsdholdings.com

manifestarz.com

sequenceanalytica.com

gethealthcaresmart.com

theartofsurprises.com

pirateequitypatrick.com

alliance-ce.com

wingrushusa.com

funtimespheres.com

solevux.com

antimasathya.com

profitexcavator.com

lankeboxshop.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a0200a4316e595561f8527e3bcf27bc.exe
    "C:\Users\Admin\AppData\Local\Temp\6a0200a4316e595561f8527e3bcf27bc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Users\Admin\AppData\Local\Temp\6a0200a4316e595561f8527e3bcf27bc.exe
      "C:\Users\Admin\AppData\Local\Temp\6a0200a4316e595561f8527e3bcf27bc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/648-66-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/648-67-0x000000000041EBD0-mapping.dmp

  • memory/648-68-0x00000000008D0000-0x0000000000BD3000-memory.dmp

    Filesize

    3.0MB

  • memory/1056-60-0x00000000010E0000-0x00000000010E1000-memory.dmp

    Filesize

    4KB

  • memory/1056-62-0x0000000004E70000-0x0000000004E71000-memory.dmp

    Filesize

    4KB

  • memory/1056-63-0x0000000000550000-0x000000000056B000-memory.dmp

    Filesize

    108KB

  • memory/1056-64-0x0000000005270000-0x00000000052E5000-memory.dmp

    Filesize

    468KB

  • memory/1056-65-0x0000000000E30000-0x0000000000E60000-memory.dmp

    Filesize

    192KB