Analysis
-
max time kernel
153s -
max time network
141s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
10-09-2021 08:20
General
-
Target
10000.exe
-
Size
184KB
-
MD5
c1a7af5210aa95abf7a60c9234edfef3
-
SHA1
775030fd15d38116673a8758ececd8e091a4dc86
-
SHA256
dd825f982712b6519ee45d665ca88adbabba747f45c645b8caeada2d8fe79b38
-
SHA512
85ee399b7a2fad74c69f55ecdd781407adce29fcdb585abaf32dc2123f7b29d0f048cfb0cdaf598139742ccec3c27d60dc89e2d52020dba9224d7ca883e86139
Malware Config
Extracted
formbook
4.1
3nop
http://www.jakesplacebarbers.com/3nop/
videohm.com
panache-rose.com
alnooncars-kw.com
trueblue2u.com
brussels-cafe.com
ip2c.net
influenzerr.com
rbcoq.com
zzful.com
drainthe.com
sumaholesson.com
cursosaprovados.com
genotecinc.com
dbrulhart.com
theapiarystudios.com
kensyu-kan.com
dkku88.com
tikhyper.com
aztecnort.com
homebrim.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 1 IoCs
-
Deletes itself 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10000.exe"C:\Users\Admin\AppData\Local\Temp\10000.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\10000.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1244-62-0x0000000004E20000-0x0000000004F51000-memory.dmpFilesize
1.2MB
-
memory/1244-70-0x0000000004A90000-0x0000000004B86000-memory.dmpFilesize
984KB
-
memory/1628-60-0x0000000000760000-0x0000000000A63000-memory.dmpFilesize
3.0MB
-
memory/1628-61-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/1640-65-0x0000000000000000-mapping.dmp
-
memory/2024-63-0x0000000000000000-mapping.dmp
-
memory/2024-64-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/2024-66-0x0000000000260000-0x0000000000364000-memory.dmpFilesize
1.0MB
-
memory/2024-67-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/2024-68-0x0000000001FB0000-0x00000000022B3000-memory.dmpFilesize
3.0MB
-
memory/2024-69-0x0000000001E90000-0x0000000001F23000-memory.dmpFilesize
588KB