Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    21-09-2021 19:48

General

  • Target

    994a9f45f0d0044d1dbe654ca8dfb4573abb6b20400b0563d8d1c88b1a6a025e~.exe

  • Size

    1.1MB

  • MD5

    6f74e34ecd92395aefc707edf4119d71

  • SHA1

    1d549f12ccf0fa9a429592795ee2c0e103534b91

  • SHA256

    b8b54b232ca4f2ee4362d0d66218e77fbd950922221ab00676d43877904e249b

  • SHA512

    a5ab2a239869020ca7fd22c1391fb4a3cc2fd0e9bbb7388c7a8d7580193e54fa5cf4195a2d786e2df0e249b92d26b84a08c88e4b10400e927b59d8e32d93cd0a

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n7ak

C2

http://www.kmresults.com/n7ak/

Decoy

modischoolcbse.com

theneverwinter.com

rszkjx-vps-hosting.website

fnihil.com

1pbet.com

nnowzscorrez.com

uaotgvjl.icu

starmapsqatar.com

ekisilani.com

extradeepsheets.com

jam-nins.com

buranly.com

orixentertainment.com

rawtech.energy

myol.guru

utex.club

jiapie.com

wowig.store

wweidlyyl.com

systaskautomation.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3060
    • C:\Users\Admin\AppData\Local\Temp\994a9f45f0d0044d1dbe654ca8dfb4573abb6b20400b0563d8d1c88b1a6a025e~.exe
      "C:\Users\Admin\AppData\Local\Temp\994a9f45f0d0044d1dbe654ca8dfb4573abb6b20400b0563d8d1c88b1a6a025e~.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3592
      • C:\Windows\SysWOW64\DpiScaling.exe
        C:\Windows\System32\DpiScaling.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3604
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\SysWOW64\rundll32.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:748
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Windows\SysWOW64\DpiScaling.exe"
            5⤵
              PID:4012

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/748-125-0x0000000000000000-mapping.dmp
    • memory/748-130-0x0000000004380000-0x0000000004413000-memory.dmp
      Filesize

      588KB

    • memory/748-129-0x0000000004600000-0x0000000004920000-memory.dmp
      Filesize

      3.1MB

    • memory/748-126-0x00000000008B0000-0x00000000008C3000-memory.dmp
      Filesize

      76KB

    • memory/748-127-0x0000000000630000-0x000000000065E000-memory.dmp
      Filesize

      184KB

    • memory/3060-131-0x00000000008C0000-0x0000000000961000-memory.dmp
      Filesize

      644KB

    • memory/3060-122-0x0000000002790000-0x0000000002855000-memory.dmp
      Filesize

      788KB

    • memory/3060-124-0x0000000004D30000-0x0000000004E67000-memory.dmp
      Filesize

      1.2MB

    • memory/3592-116-0x0000000002250000-0x0000000002251000-memory.dmp
      Filesize

      4KB

    • memory/3604-123-0x0000000004F80000-0x0000000004F94000-memory.dmp
      Filesize

      80KB

    • memory/3604-120-0x0000000004C60000-0x0000000004F80000-memory.dmp
      Filesize

      3.1MB

    • memory/3604-121-0x0000000004AE0000-0x0000000004AF4000-memory.dmp
      Filesize

      80KB

    • memory/3604-118-0x0000000000B20000-0x0000000000B21000-memory.dmp
      Filesize

      4KB

    • memory/3604-119-0x0000000010410000-0x000000001043E000-memory.dmp
      Filesize

      184KB

    • memory/3604-117-0x0000000000000000-mapping.dmp
    • memory/4012-128-0x0000000000000000-mapping.dmp