Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en -
submitted
10-09-2021 06:36
General
-
Target
10000.exe
-
Size
184KB
-
MD5
c1a7af5210aa95abf7a60c9234edfef3
-
SHA1
775030fd15d38116673a8758ececd8e091a4dc86
-
SHA256
dd825f982712b6519ee45d665ca88adbabba747f45c645b8caeada2d8fe79b38
-
SHA512
85ee399b7a2fad74c69f55ecdd781407adce29fcdb585abaf32dc2123f7b29d0f048cfb0cdaf598139742ccec3c27d60dc89e2d52020dba9224d7ca883e86139
Malware Config
Extracted
formbook
4.1
3nop
http://www.jakesplacebarbers.com/3nop/
videohm.com
panache-rose.com
alnooncars-kw.com
trueblue2u.com
brussels-cafe.com
ip2c.net
influenzerr.com
rbcoq.com
zzful.com
drainthe.com
sumaholesson.com
cursosaprovados.com
genotecinc.com
dbrulhart.com
theapiarystudios.com
kensyu-kan.com
dkku88.com
tikhyper.com
aztecnort.com
homebrim.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 1 IoCs
-
Deletes itself 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10000.exe"C:\Users\Admin\AppData\Local\Temp\10000.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\10000.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-53-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/624-54-0x0000000000160000-0x0000000000174000-memory.dmpFilesize
80KB
-
memory/1204-55-0x00000000068B0000-0x0000000006A0B000-memory.dmpFilesize
1.4MB
-
memory/1204-63-0x0000000006CD0000-0x0000000006E49000-memory.dmpFilesize
1.5MB
-
memory/1356-61-0x0000000000000000-mapping.dmp
-
memory/1744-56-0x0000000000000000-mapping.dmp
-
memory/1744-57-0x00000000756A1000-0x00000000756A3000-memory.dmpFilesize
8KB
-
memory/1744-59-0x0000000000130000-0x000000000015E000-memory.dmpFilesize
184KB
-
memory/1744-58-0x0000000000F50000-0x0000000000F5E000-memory.dmpFilesize
56KB
-
memory/1744-60-0x0000000002360000-0x0000000002663000-memory.dmpFilesize
3.0MB
-
memory/1744-62-0x0000000000980000-0x0000000000A13000-memory.dmpFilesize
588KB