Overview

overview

10

Static

static

1

Rechnungsz...om.exe

windows7_x64

10

Rechnungsz...om.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    11-10-2021 17:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Rechnungszahlung.com.exe

  • Size

    416KB

  • MD5

    a40d9c6f964664b6b5a3ec4ed532df6c

  • SHA1

    4c1b1a2a6610c2f262c41112364e6629d11eb7f9

  • SHA256

    2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea

  • SHA512

    be4f84af50a13e4527d0da3c4ec91aae2ea2ee52e40066699fae1a11265f734d21c84b59c6ab58219014755c33ceb1b92ff13580b09b475644b40673231652b6

Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 3 IoCs
    rat
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Temp\Rechnungszahlung.com.exe
      "C:\Users\Admin\AppData\Local\Temp\Rechnungszahlung.com.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Users\Admin\AppData\Local\Temp\Rechnungszahlung.com.exe
        "C:\Users\Admin\AppData\Local\Temp\Rechnungszahlung.com.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3124
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Rechnungszahlung.com.exe"
        3⤵
          PID:1060

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsiA4DD.tmp\xztemc.dll
      MD5

      9c1dba61231005537c4154af2d66b50a

      SHA1

      8a51892b643ace4c1a99b45e5b03df795b8bb984

      SHA256

      4f46b2449a7bd7a664b9328f240fc3bfa522e36918a0b672bec3015761d0b67d

      SHA512

      cd2fbf5b0a67885cd20dfb2fda999c0d9136d34e3c90745d39acf54a5bcf943e8eeb9ea9a53aa179f10aebec84e360582bdaa81604b879a05ef20813533c0ab7

      Download Submit
    • memory/1060-123-0x0000000000000000-mapping.dmp
      Download
    • memory/3064-128-0x0000000004E20000-0x0000000004F43000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/3064-121-0x0000000004CC0000-0x0000000004E16000-memory.dmp
      Filesize

      1.3MB

      Download
    • memory/3124-116-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/3124-117-0x000000000041F200-mapping.dmp
      Download
    • memory/3124-119-0x0000000000B30000-0x0000000000E50000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/3124-120-0x00000000005C0000-0x00000000005D5000-memory.dmp
      Filesize

      84KB

      Download
    • memory/4092-122-0x0000000000000000-mapping.dmp
      Download
    • memory/4092-125-0x0000000002D00000-0x0000000002D2F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/4092-126-0x0000000004F80000-0x00000000052A0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/4092-127-0x0000000004CE0000-0x0000000004D74000-memory.dmp
      Filesize

      592KB

      Download
    • memory/4092-124-0x0000000000890000-0x0000000000CCF000-memory.dmp
      Filesize

      4.2MB

      Download