Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    12-10-2021 10:45

General

  • Target

    dllhost.exe

  • Size

    485KB

  • MD5

    1fe73fe4d37cae6a02262b5164f3def0

  • SHA1

    80b03eb27651723bded1fd1425f489225b3bba3b

  • SHA256

    0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

  • SHA512

    7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload ⋅ 3 IoCs
  • Suspicious use of SetThreadContext ⋅ 3 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 46 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 5 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious use of UnmapMainImage ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of UnmapMainImage
    Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\dllhost.exe
      "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Users\Admin\AppData\Local\Temp\dllhost.exe
        "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        PID:3828
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3900
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
        PID:1988

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/1988-134-0x0000000000000000-mapping.dmp
                          • memory/3016-137-0x0000000003250000-0x0000000003311000-memory.dmp
                          • memory/3016-128-0x0000000006E30000-0x0000000006FA2000-memory.dmp
                          • memory/3828-123-0x0000000000400000-0x000000000042E000-memory.dmp
                          • memory/3828-127-0x0000000001160000-0x0000000001174000-memory.dmp
                          • memory/3828-126-0x0000000001270000-0x0000000001590000-memory.dmp
                          • memory/3828-124-0x000000000041EB80-mapping.dmp
                          • memory/3900-131-0x00000000001E0000-0x00000000001E1000-memory.dmp
                          • memory/3900-132-0x00000000001B0000-0x00000000001C2000-memory.dmp
                          • memory/3900-136-0x00000000041F0000-0x0000000004283000-memory.dmp
                          • memory/3900-135-0x0000000004380000-0x00000000046A0000-memory.dmp
                          • memory/3900-133-0x0000000002380000-0x00000000023AE000-memory.dmp
                          • memory/3900-130-0x00000000001E0000-0x00000000001E1000-memory.dmp
                          • memory/3900-129-0x0000000000000000-mapping.dmp
                          • memory/4060-118-0x00000000049F0000-0x00000000049F1000-memory.dmp
                          • memory/4060-114-0x0000000000150000-0x0000000000151000-memory.dmp
                          • memory/4060-119-0x0000000004990000-0x0000000004E8E000-memory.dmp
                          • memory/4060-122-0x00000000065D0000-0x0000000006620000-memory.dmp
                          • memory/4060-117-0x0000000004A30000-0x0000000004A31000-memory.dmp
                          • memory/4060-120-0x0000000004D30000-0x0000000004D35000-memory.dmp
                          • memory/4060-121-0x0000000006530000-0x0000000006531000-memory.dmp
                          • memory/4060-116-0x0000000004E90000-0x0000000004E91000-memory.dmp