Overview

overview

10

Static

static

1

Nouvel ordre.exe

windows7_x64

10

Nouvel ordre.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    04-10-2021 10:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Nouvel ordre.exe

  • Size

    259KB

  • MD5

    ba2cd86b94baeb58becd532319250fe2

  • SHA1

    31e88e27c5840c2a0b7840d3c4c0acd489f0a8e5

  • SHA256

    6d725aa4c3dd38bc7f924af4891b82a9c993e2db67765c72be42778a9c1b561a

  • SHA512

    7c3b2b3c3446bd2c1ea04c2d84cfed87ee5b686af62702a06199619e2a96fba300b7ac91a1f14699e38d53ae342d16b38436bc9b2c54bc8967366d6031fc549b

Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 3 IoCs
    rat
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
      "C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:632
      • C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe
        "C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:856
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\SysWOW64\control.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:836
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Nouvel ordre.exe"
        3⤵
          PID:1144

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsr80A5.tmp\cbspar.dll
      MD5

      31bff8b807f552a663c1a9b37a130564

      SHA1

      c91442fdd89050d3a37d234eb6595f11f1697afa

      SHA256

      8c25e6add26bc8ff4c545ced91b02663a2ba8222f1b5e5208910705186c12c9b

      SHA512

      316cae0648c6ec274b9d2f2ef13d3cc4033505f6859e0ad836bedbbee35356bb0ddaa18eb3d1cc71ec90885188d9df4ba7e41f6e09af4b417f9d475964e848c6

      Download Submit
    • memory/836-121-0x00000000001C0000-0x00000000001E0000-memory.dmp
      Filesize

      128KB

      Download
    • memory/836-120-0x0000000000000000-mapping.dmp
      Download
    • memory/836-122-0x0000000002920000-0x000000000294F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/836-123-0x0000000004550000-0x0000000004870000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/836-125-0x00000000043B0000-0x0000000004444000-memory.dmp
      Filesize

      592KB

      Download
    • memory/856-116-0x000000000041F200-mapping.dmp
      Download
    • memory/856-117-0x0000000000A10000-0x0000000000D30000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/856-118-0x00000000009D0000-0x00000000009E5000-memory.dmp
      Filesize

      84KB

      Download
    • memory/856-115-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/1144-124-0x0000000000000000-mapping.dmp
      Download
    • memory/2428-119-0x00000000049F0000-0x0000000004B96000-memory.dmp
      Filesize

      1.6MB

      Download
    • memory/2428-126-0x0000000000400000-0x00000000004B4000-memory.dmp
      Filesize

      720KB

      Download