Analysis

  • max time kernel
    153s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    24-09-2021 11:24

General

  • Target

    Orden de compra.exe

  • Size

    702KB

  • MD5

    ecd71709287a9ff558013bee1575c5bc

  • SHA1

    e81ef75586e2b391ade4cbb62d60aa50cf00c964

  • SHA256

    b6788527f99a436b0e8925eb14c8800ced61fd406edd4182aa00072b3f74f39e

  • SHA512

    3dfddac63d09b61c702d4d7ee615f85a49683b1610eac36625419116381d68f899d652dea942f2d362aae621d9705ec4557827903d0d6d398a056b3754c7019c

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

C2

http://www.jakesplacebarbers.com/3nop/

Decoy

videohm.com

panache-rose.com

alnooncars-kw.com

trueblue2u.com

brussels-cafe.com

ip2c.net

influenzerr.com

rbcoq.com

zzful.com

drainthe.com

sumaholesson.com

cursosaprovados.com

genotecinc.com

dbrulhart.com

theapiarystudios.com

kensyu-kan.com

dkku88.com

tikhyper.com

aztecnort.com

homebrim.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Users\Admin\AppData\Local\Temp\Orden de compra.exe
      "C:\Users\Admin\AppData\Local\Temp\Orden de compra.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Windows\SysWOW64\secinit.exe
        secinit.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2584
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\secinit.exe"
        3⤵
          PID:3792

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1840-116-0x00000000005D0000-0x000000000071A000-memory.dmp
      Filesize

      1.3MB

    • memory/2584-124-0x0000000002D80000-0x0000000002D94000-memory.dmp
      Filesize

      80KB

    • memory/2584-120-0x0000000010410000-0x000000001043E000-memory.dmp
      Filesize

      184KB

    • memory/2584-119-0x0000000000A30000-0x0000000000A31000-memory.dmp
      Filesize

      4KB

    • memory/2584-121-0x0000000004AE0000-0x0000000004E00000-memory.dmp
      Filesize

      3.1MB

    • memory/2584-118-0x0000000000000000-mapping.dmp
    • memory/2584-122-0x0000000002C00000-0x0000000002D4A000-memory.dmp
      Filesize

      1.3MB

    • memory/2824-128-0x0000000003010000-0x000000000303E000-memory.dmp
      Filesize

      184KB

    • memory/2824-126-0x0000000000000000-mapping.dmp
    • memory/2824-127-0x00000000009A0000-0x00000000009B3000-memory.dmp
      Filesize

      76KB

    • memory/2824-129-0x0000000004BB0000-0x0000000004ED0000-memory.dmp
      Filesize

      3.1MB

    • memory/2824-131-0x0000000004A20000-0x0000000004AB3000-memory.dmp
      Filesize

      588KB

    • memory/2972-125-0x0000000005A10000-0x0000000005AFA000-memory.dmp
      Filesize

      936KB

    • memory/2972-123-0x00000000030E0000-0x00000000031CC000-memory.dmp
      Filesize

      944KB

    • memory/2972-132-0x00000000066C0000-0x0000000006759000-memory.dmp
      Filesize

      612KB

    • memory/3792-130-0x0000000000000000-mapping.dmp