Overview

overview

10

Static

static

10

1.exe

windows7_x64

10

1.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    17/09/2021, 09:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1.exe
  • Size 184KB
  • Sample210917-k7ydgsfbb8
  • SHA256 561bedc1d6d589037ade015eb53f01c045fbd770982e04dc1b7a2acc677d67f4
  • MD5 SHA1 SHA512
Score
10/10
formbook3nopratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • 3nop

C2

  • http://www.jakesplacebarbers.com/3nop/

Decoy

  • videohm.com

  • panache-rose.com

  • alnooncars-kw.com

  • trueblue2u.com

  • brussels-cafe.com

  • ip2c.net

  • influenzerr.com

  • rbcoq.com

  • zzful.com

  • drainthe.com

  • sumaholesson.com

  • cursosaprovados.com

  • genotecinc.com

  • dbrulhart.com

  • theapiarystudios.com

  • kensyu-kan.com

  • dkku88.com

  • tikhyper.com

  • aztecnort.com

  • homebrim.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 1 IoCs
    rat
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:652
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\1.exe"
        3⤵
          PID:392

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/652-115-0x0000000000CD0000-0x0000000000CE4000-memory.dmp
          Download

          memory/652-114-0x0000000001140000-0x0000000001460000-memory.dmp
          Download

          memory/816-120-0x0000000003080000-0x00000000030AE000-memory.dmp
          Download

          memory/816-119-0x0000000000920000-0x0000000000A93000-memory.dmp
          Download

          memory/816-121-0x00000000047D0000-0x0000000004AF0000-memory.dmp
          Download

          memory/816-122-0x00000000046D0000-0x0000000004763000-memory.dmp
          Download

          memory/2724-116-0x0000000005310000-0x0000000005453000-memory.dmp
          Download

          memory/2724-123-0x0000000002CA0000-0x0000000002D7F000-memory.dmp
          Download