Overview

overview

10

Static

static

1

rrfee1234.exe

windows7_x64

10

rrfee1234.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    04-10-2021 13:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    rrfee1234.exe

  • Size

    257KB

  • MD5

    ec50a0d1ba634421cc3301633343ed04

  • SHA1

    bbb06fe1fb5e61e37a3e709228064ee318e6c74d

  • SHA256

    fa0d4eeae6c743ddc44d9664b0e6d44238beff477d1f4e9a560e68026a4264d9

  • SHA512

    39ce4a5d8ae8c33b8fda65443f7decc9661cc4ab4734810530bda3a8ab769223ce56b66eff1f679f4cb7da9fcfe14cfce7d17ae1576c99c4eb51bd20063de023

Score
10/10
formbookrv9nratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

C2

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata
  • Formbook Payload 3 IoCs
    rat
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Users\Admin\AppData\Local\Temp\rrfee1234.exe
      "C:\Users\Admin\AppData\Local\Temp\rrfee1234.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:808
      • C:\Users\Admin\AppData\Local\Temp\rrfee1234.exe
        "C:\Users\Admin\AppData\Local\Temp\rrfee1234.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:368
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\rrfee1234.exe"
        3⤵
          PID:1208

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsi83C2.tmp\jsgdacail.dll
      MD5

      c3755ba829fe0ac168fde4f1f37ff531

      SHA1

      e534376fcaf95c9284fb242f8b962a85783e2956

      SHA256

      50d2bcd4477dc52e7c5dd1d2ee59a78133cb4ae3dd367aadc22053de8137a977

      SHA512

      d55473705589e789d5f92f79cf1c7dcefb7db21976829fc036593ef5de1eaf02a0c002fc9457b65314bba33bd6a05d06e31341bb147472f2160136e189c0a30b

      Download Submit
    • memory/368-115-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/368-116-0x000000000041F120-mapping.dmp
      Download
    • memory/368-117-0x0000000000A80000-0x0000000000DA0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/368-118-0x00000000004A0000-0x00000000005EA000-memory.dmp
      Filesize

      1.3MB

      Download
    • memory/1028-120-0x0000000000000000-mapping.dmp
      Download
    • memory/1028-122-0x0000000000E10000-0x0000000000E16000-memory.dmp
      Filesize

      24KB

      Download
    • memory/1028-123-0x0000000000150000-0x000000000017F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/1028-124-0x00000000043C0000-0x00000000046E0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/1028-125-0x0000000000C50000-0x0000000000CE3000-memory.dmp
      Filesize

      588KB

      Download
    • memory/1208-121-0x0000000000000000-mapping.dmp
      Download
    • memory/3052-119-0x0000000006980000-0x0000000006A4A000-memory.dmp
      Filesize

      808KB

      Download
    • memory/3052-126-0x0000000004DA0000-0x0000000004EBC000-memory.dmp
      Filesize

      1.1MB

      Download