Overview

overview

10

Static

static

Orden de compra.exe

windows7_x64

10

Orden de compra.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    23-09-2021 14:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Orden de compra.exe

  • Size

    810KB

  • MD5

    b93a2f5eb85ed74a4a3483fe63f2efe2

  • SHA1

    12317fddd8b32f7cc235a5d63578a7d4d98d1131

  • SHA256

    8bc32885f532e286073afa7781733d97338f3bab7b22f55680b38fe1926d103b

  • SHA512

    deab2026dd2ca94a7a26996f434e9e936b7678f1d5ae32a9afa604634ac88686ca066f5735aa7aff3b6b6fdbf5c3484a8b66fd3879b5f52d4cf5e83a312265cc

Score
10/10
formbook3nopratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

C2

http://www.jakesplacebarbers.com/3nop/

Decoy

videohm.com

panache-rose.com

alnooncars-kw.com

trueblue2u.com

brussels-cafe.com

ip2c.net

influenzerr.com

rbcoq.com

zzful.com

drainthe.com

sumaholesson.com

cursosaprovados.com

genotecinc.com

dbrulhart.com

theapiarystudios.com

kensyu-kan.com

dkku88.com

tikhyper.com

aztecnort.com

homebrim.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata
  • Formbook Payload 3 IoCs
    rat
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\Orden de compra.exe
      "C:\Users\Admin\AppData\Local\Temp\Orden de compra.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:628
      • C:\Windows\SysWOW64\DpiScaling.exe
        DpiScaling.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:568
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:1088
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1176
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\SysWOW64\DpiScaling.exe"
          3⤵
            PID:1396

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/568-116-0x0000000000000000-mapping.dmp
        Download
      • memory/568-117-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/568-118-0x0000000010410000-0x000000001043E000-memory.dmp
        Filesize

        184KB

        Download
      • memory/568-119-0x0000000004CD0000-0x0000000004FF0000-memory.dmp
        Filesize

        3.1MB

        Download
      • memory/568-120-0x00000000030E0000-0x00000000030F4000-memory.dmp
        Filesize

        80KB

        Download
      • memory/628-114-0x0000000000A00000-0x0000000000A01000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1176-124-0x0000000000190000-0x00000000005CF000-memory.dmp
        Filesize

        4.2MB

        Download
      • memory/1176-122-0x0000000000000000-mapping.dmp
        Download
      • memory/1176-125-0x0000000002CF0000-0x0000000002D1E000-memory.dmp
        Filesize

        184KB

        Download
      • memory/1176-126-0x0000000004980000-0x0000000004CA0000-memory.dmp
        Filesize

        3.1MB

        Download
      • memory/1176-127-0x0000000004710000-0x00000000047A3000-memory.dmp
        Filesize

        588KB

        Download
      • memory/1396-123-0x0000000000000000-mapping.dmp
        Download
      • memory/2996-121-0x0000000006250000-0x00000000063AB000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/2996-128-0x0000000006450000-0x0000000006568000-memory.dmp
        Filesize

        1.1MB

        Download