Analysis
-
max time kernel
152s -
max time network
169s -
platform
windows10_x64 -
resource
win10-en -
submitted
16-09-2021 12:11
General
-
Target
Yeni Satinalma Sifarisi.exe
-
Size
792KB
-
MD5
3c1181489ccff99bc9b8cda800381525
-
SHA1
cb466992514ba4541bb7776ce0fbdfa75840028e
-
SHA256
5145f1759e79b4d29641c6c604173b0bae2a3d7b156b49e8c267da63e0cd94d6
-
SHA512
0bfaee9018cab7bde98116563875dcb1aeb95765b159e38d201d54daf114071de9bfc5a360ca79c994e3d73f5fc5b2b57193f0a384fac93dd959a9ff32cb6f56
Malware Config
Extracted
formbook
4.1
3nop
http://www.jakesplacebarbers.com/3nop/
videohm.com
panache-rose.com
alnooncars-kw.com
trueblue2u.com
brussels-cafe.com
ip2c.net
influenzerr.com
rbcoq.com
zzful.com
drainthe.com
sumaholesson.com
cursosaprovados.com
genotecinc.com
dbrulhart.com
theapiarystudios.com
kensyu-kan.com
dkku88.com
tikhyper.com
aztecnort.com
homebrim.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Yeni Satinalma Sifarisi.exe"C:\Users\Admin\AppData\Local\Temp\Yeni Satinalma Sifarisi.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\secinit.exeC:\Windows\System32\secinit.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\secinit.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-128-0x0000000000000000-mapping.dmp
-
memory/744-118-0x0000000000620000-0x000000000076A000-memory.dmpFilesize
1.3MB
-
memory/872-126-0x0000000000290000-0x00000000006CF000-memory.dmpFilesize
4.2MB
-
memory/872-130-0x0000000004600000-0x0000000004693000-memory.dmpFilesize
588KB
-
memory/872-129-0x0000000004840000-0x0000000004B60000-memory.dmpFilesize
3.1MB
-
memory/872-125-0x0000000000000000-mapping.dmp
-
memory/872-127-0x00000000027D0000-0x00000000027FE000-memory.dmpFilesize
184KB
-
memory/3008-131-0x0000000005EC0000-0x0000000005FC9000-memory.dmpFilesize
1.0MB
-
memory/3008-124-0x00000000077A0000-0x00000000078A8000-memory.dmpFilesize
1.0MB
-
memory/3100-120-0x00000000032B0000-0x00000000032B1000-memory.dmpFilesize
4KB
-
memory/3100-122-0x0000000005120000-0x0000000005440000-memory.dmpFilesize
3.1MB
-
memory/3100-123-0x0000000005080000-0x0000000005094000-memory.dmpFilesize
80KB
-
memory/3100-121-0x0000000010410000-0x000000001043E000-memory.dmpFilesize
184KB
-
memory/3100-119-0x0000000000000000-mapping.dmp