Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    03-11-2021 14:02

General

  • Target

    BANK SLIP.exe

  • Size

    464KB

  • MD5

    b94efb11bb057e324e00967a077a9c3f

  • SHA1

    a96358b10168fce176481019f26e9d331c03ee57

  • SHA256

    93570be59d8c3f3608ffe0b137503c6555e6f40514af2c22989fe61a2394ecd5

  • SHA512

    2f968024ee4d1e9a46cf4067d467cc37e0ea4967060b09d2b59410670bac907d18fbb6fa757b44abe7978edeadb9bb19d8621c95cb6b9740edceca35a5043685

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

r4gk

C2

http://www.aprilsaak.quest/r4gk/

Decoy

quantalix.com

animalblog-eggs.com

039skz.xyz

guttas.net

lasantadayparty.com

protegerfinanceservices.com

vixtest.xyz

digitaleconomy.global

0xpax.xyz

mobilehome1688.com

themotionpartners.com

valueney.com

hattuafhv.quest

js0061gj.net

360metaverse.biz

seculardata.com

346727688.xyz

smartmapom.com

moksel.com

exoduswatchco.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 4 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\BANK SLIP.exe
      "C:\Users\Admin\AppData\Local\Temp\BANK SLIP.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1440
      • C:\Users\Admin\AppData\Local\Temp\BANK SLIP.exe
        "C:\Users\Admin\AppData\Local\Temp\BANK SLIP.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1388
    • C:\Windows\SysWOW64\help.exe
      "C:\Windows\SysWOW64\help.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\BANK SLIP.exe"
        3⤵
        • Deletes itself
        PID:972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/972-75-0x0000000000000000-mapping.dmp
  • memory/1348-68-0x0000000004C80000-0x0000000004D61000-memory.dmp
    Filesize

    900KB

  • memory/1348-78-0x0000000007AE0000-0x0000000007C49000-memory.dmp
    Filesize

    1.4MB

  • memory/1348-71-0x00000000069E0000-0x0000000006B6C000-memory.dmp
    Filesize

    1.5MB

  • memory/1388-67-0x00000000001E0000-0x00000000001F4000-memory.dmp
    Filesize

    80KB

  • memory/1388-70-0x00000000003D0000-0x00000000003E4000-memory.dmp
    Filesize

    80KB

  • memory/1388-62-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1388-64-0x000000000041F110-mapping.dmp
  • memory/1388-63-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1388-66-0x0000000000830000-0x0000000000B33000-memory.dmp
    Filesize

    3.0MB

  • memory/1388-61-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1388-69-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1440-60-0x00000000049A0000-0x00000000049F2000-memory.dmp
    Filesize

    328KB

  • memory/1440-55-0x0000000000160000-0x0000000000161000-memory.dmp
    Filesize

    4KB

  • memory/1440-59-0x0000000000280000-0x0000000000286000-memory.dmp
    Filesize

    24KB

  • memory/1440-58-0x0000000004A20000-0x0000000004A21000-memory.dmp
    Filesize

    4KB

  • memory/1440-57-0x00000000757A1000-0x00000000757A3000-memory.dmp
    Filesize

    8KB

  • memory/1932-72-0x0000000000000000-mapping.dmp
  • memory/1932-73-0x0000000000110000-0x0000000000116000-memory.dmp
    Filesize

    24KB

  • memory/1932-74-0x00000000000C0000-0x00000000000EF000-memory.dmp
    Filesize

    188KB

  • memory/1932-76-0x00000000006D0000-0x00000000009D3000-memory.dmp
    Filesize

    3.0MB

  • memory/1932-77-0x00000000004F0000-0x0000000000583000-memory.dmp
    Filesize

    588KB