Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
18-10-2021 17:00
General
-
Target
Specifiche dell'ordine.com.exe
-
Size
252KB
-
MD5
58d5b91e06edbf8ace5b5ebe98cdf558
-
SHA1
39c4c5887e7f0d0165dfa4ab9d1d48583f33b529
-
SHA256
0cdc382e574649336b29e110c3d121e8158e895b3d2de22ba5db63fa61cf01c8
-
SHA512
2071222a8bf6c4e969a2c2a2c987b163cbc7bb0380983ced1bcc7e79aa7ae9fc96479a565c479602b70b7530b6008514786fbdce7e202df38415e6a2d3599e7f
Malware Config
Extracted
formbook
4.1
dn7r
http://www.yourherogarden.net/dn7r/
eventphotographerdfw.com
thehalalcoinstaking.com
philipfaziofineart.com
intercoh.com
gaiaseyephotography.com
chatbotforrealestate.com
lovelancemg.com
marlieskasberger.com
elcongoenespanol.info
lepirecredit.com
distribution-concept.com
e99game.com
exit11festival.com
twodollartoothbrushclub.com
cocktailsandlawn.com
performimprove.network
24horas-telefono-11840.com
cosmossify.com
kellenleote.com
perovskite.energy
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Specifiche dell'ordine.com.exe"C:\Users\Admin\AppData\Local\Temp\Specifiche dell'ordine.com.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Specifiche dell'ordine.com.exe"C:\Users\Admin\AppData\Local\Temp\Specifiche dell'ordine.com.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Specifiche dell'ordine.com.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nseA72F.tmp\cumngswsx.dllMD5
4057e57c6e1875d064b9121cb8938305
SHA19236cd3432026b30eb775eb150226f7d011ea972
SHA256535b06a16ef271c819284452045366e46cdbc3c6c8c6ed01b64d46b269e2fff0
SHA5124b1b5689440c4bd29adfe3daaad6ca0febb0a9b963cd19ba99a7323993221e33e5baf469b652bd8ffc9c46eb6a86a1e8c3c1100fb3d4b664b6c43a4e955cdc78
-
memory/1764-125-0x0000000000000000-mapping.dmp
-
memory/2256-122-0x0000000000000000-mapping.dmp
-
memory/2256-124-0x0000000000E50000-0x0000000000E7F000-memory.dmpFilesize
188KB
-
memory/2256-123-0x0000000000F60000-0x0000000000F6B000-memory.dmpFilesize
44KB
-
memory/2256-126-0x0000000003590000-0x00000000038B0000-memory.dmpFilesize
3.1MB
-
memory/2256-127-0x0000000003450000-0x00000000034E4000-memory.dmpFilesize
592KB
-
memory/2848-121-0x0000000005DC0000-0x0000000005F35000-memory.dmpFilesize
1.5MB
-
memory/2848-128-0x0000000004FB0000-0x000000000512C000-memory.dmpFilesize
1.5MB
-
memory/3852-120-0x00000000006D0000-0x00000000006E5000-memory.dmpFilesize
84KB
-
memory/3852-119-0x0000000000B20000-0x0000000000E40000-memory.dmpFilesize
3.1MB
-
memory/3852-117-0x000000000041F200-mapping.dmp
-
memory/3852-116-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB