Analysis

  • max time kernel
    148s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    21-10-2021 17:28

General

  • Target

    order 0091.com.exe

  • Size

    427KB

  • MD5

    c6d40c961c2a1940c29ff433fc9217ee

  • SHA1

    a55d2f584620864fe9eb49e7647bb86fc2c20050

  • SHA256

    cf0d36f933310c07f1554db7e6e8a2e79c01ee933717e13f96ae841302306512

  • SHA512

    97c9df9f0492303c86a94e0fb25edac5cbd23e30cc4bcddc00ef47f7b70a7642da57f144bfa505a3ef0cad2de7f8d4fe464e58df931aeb54861e57c84f65fff7

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Users\Admin\AppData\Local\Temp\order 0091.com.exe
      "C:\Users\Admin\AppData\Local\Temp\order 0091.com.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:712
      • C:\Users\Admin\AppData\Local\Temp\order 0091.com.exe
        "C:\Users\Admin\AppData\Local\Temp\order 0091.com.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3460
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2112
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\order 0091.com.exe"
        3⤵
          PID:1600

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsvC546.tmp\brfrqelhtqi.dll
      MD5

      08f8c05553706af957306d9cce346ebb

      SHA1

      bc1ccb5f00c582752d4a5103b122fe5299dad8d4

      SHA256

      628e6ecd0231ccdefd6d684a8d0f07ff16f0213ae04e29adb7ff94853cce2cc3

      SHA512

      3dd9ea6672f45734931e194b066fe042a4d79e6cdd8a8999b874b7a4eaacf09d123e77d996be795b0d6e131fd9555e17fd4af445c1ad8c9a9cd3cb5f0ec1e0a1

    • memory/1600-123-0x0000000000000000-mapping.dmp
    • memory/2112-125-0x0000000003050000-0x000000000307F000-memory.dmp
      Filesize

      188KB

    • memory/2112-122-0x0000000000000000-mapping.dmp
    • memory/2112-124-0x0000000000950000-0x0000000000967000-memory.dmp
      Filesize

      92KB

    • memory/2112-126-0x0000000003590000-0x00000000038B0000-memory.dmp
      Filesize

      3.1MB

    • memory/2112-127-0x0000000003270000-0x0000000003304000-memory.dmp
      Filesize

      592KB

    • memory/3056-121-0x0000000004D20000-0x0000000004E88000-memory.dmp
      Filesize

      1.4MB

    • memory/3056-128-0x0000000005B70000-0x0000000005CB4000-memory.dmp
      Filesize

      1.3MB

    • memory/3460-119-0x00000000009F0000-0x0000000000D10000-memory.dmp
      Filesize

      3.1MB

    • memory/3460-120-0x00000000009D0000-0x00000000009E5000-memory.dmp
      Filesize

      84KB

    • memory/3460-117-0x000000000041F200-mapping.dmp
    • memory/3460-116-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB