Overview

overview

10

Static

static

10

1.exe

windows7_x64

10

1.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    17-09-2021 09:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1.exe

  • Size

    184KB

  • MD5

    b40cb0308a54ac1d3b997a74afa5d760

  • SHA1

    d114b90c7838201624a3faf512d00c74095baa16

  • SHA256

    561bedc1d6d589037ade015eb53f01c045fbd770982e04dc1b7a2acc677d67f4

  • SHA512

    e7e47000809d41cfcb9f82976fbf8972c1c3f6783f39a44234d6e4c519709e3bf82abddd072128630734d5297a0bca1471fb7a1377b9340b4e0b438c86b598a4

Score
10/10
formbook3nopratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

C2

http://www.jakesplacebarbers.com/3nop/

Decoy

videohm.com

panache-rose.com

alnooncars-kw.com

trueblue2u.com

brussels-cafe.com

ip2c.net

influenzerr.com

rbcoq.com

zzful.com

drainthe.com

sumaholesson.com

cursosaprovados.com

genotecinc.com

dbrulhart.com

theapiarystudios.com

kensyu-kan.com

dkku88.com

tikhyper.com

aztecnort.com

homebrim.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 1 IoCs
    rat
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:652
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\1.exe"
        3⤵
          PID:392

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/392-118-0x0000000000000000-mapping.dmp
      Download
    • memory/652-115-0x0000000000CD0000-0x0000000000CE4000-memory.dmp
      Filesize

      80KB

      Download
    • memory/652-114-0x0000000001140000-0x0000000001460000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/816-117-0x0000000000000000-mapping.dmp
      Download
    • memory/816-120-0x0000000003080000-0x00000000030AE000-memory.dmp
      Filesize

      184KB

      Download
    • memory/816-119-0x0000000000920000-0x0000000000A93000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/816-121-0x00000000047D0000-0x0000000004AF0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/816-122-0x00000000046D0000-0x0000000004763000-memory.dmp
      Filesize

      588KB

      Download
    • memory/2724-116-0x0000000005310000-0x0000000005453000-memory.dmp
      Filesize

      1.3MB

      Download
    • memory/2724-123-0x0000000002CA0000-0x0000000002D7F000-memory.dmp
      Filesize

      892KB

      Download