Analysis

  • max time kernel
    151s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    25-11-2021 16:47

General

  • Target

    mpomzx.exe

  • Size

    309KB

  • MD5

    586f7a1895ea47a462b1d5f6a43fcd33

  • SHA1

    c41cd420af421d31faede9294af1a2edc638d543

  • SHA256

    1358d88e078f1c59b546256968179bf213928f1e6f4e7afa255681b2cd8f92a2

  • SHA512

    2783c07faa3bba31c1a8bdc83ce338ea43ccb044f0af5adf2ede8b8f4534b86536f069b35fad8d6ed4413cc86fac0121632e9db39de919275403547ebff1a130

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vngb

C2

http://www.gvlc0.club/vngb/

Decoy

omertalasvegas.com

payyep.com

modasportss.com

gestionestrategicadl.com

teamolemiss.club

geektranslate.com

versatileventure.com

athletic-hub.com

vitanovaretreats.com

padison8t.com

tutoeasy.com

ediblewholesale.com

kangrungao.com

satode.com

prohibitionfeeds.com

getmorevacations.com

blinkworldbeauty.com

kdlabsallr.com

almanasef.com

transportationservicellc.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Users\Admin\AppData\Local\Temp\mpomzx.exe
      "C:\Users\Admin\AppData\Local\Temp\mpomzx.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Users\Admin\AppData\Local\Temp\mpomzx.exe
        "C:\Users\Admin\AppData\Local\Temp\mpomzx.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3032
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:700
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\mpomzx.exe"
        3⤵
          PID:3140

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nseCBF.tmp\advp.dll
      MD5

      47a7fbebea22292c405e44ec919c60fc

      SHA1

      23c5ee9e29719cd957b629da0901e706259adc46

      SHA256

      0feea087bbb6afebb6c50e8d20b2e00263b1db8744c54d11a39a77e0b0bd3473

      SHA512

      f142390694e739d498f8148c86e14e6b8f3436a091841574e7683233d0511e2c0896afededad91680423b626aa2cf9ce2bf106a56ead99bb0fce25c5c609068c

    • memory/700-125-0x0000000000000000-mapping.dmp
    • memory/700-130-0x0000000004740000-0x00000000047D3000-memory.dmp
      Filesize

      588KB

    • memory/700-129-0x00000000048E0000-0x0000000004C00000-memory.dmp
      Filesize

      3.1MB

    • memory/700-126-0x0000000000900000-0x0000000000913000-memory.dmp
      Filesize

      76KB

    • memory/700-127-0x0000000000830000-0x000000000085F000-memory.dmp
      Filesize

      188KB

    • memory/2792-131-0x0000000007120000-0x000000000727D000-memory.dmp
      Filesize

      1.4MB

    • memory/2792-121-0x0000000006E30000-0x0000000006FB7000-memory.dmp
      Filesize

      1.5MB

    • memory/2792-124-0x0000000006FC0000-0x000000000711A000-memory.dmp
      Filesize

      1.4MB

    • memory/3032-119-0x0000000000A80000-0x0000000000DA0000-memory.dmp
      Filesize

      3.1MB

    • memory/3032-123-0x0000000000620000-0x0000000000634000-memory.dmp
      Filesize

      80KB

    • memory/3032-122-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/3032-120-0x00000000005E0000-0x00000000005F4000-memory.dmp
      Filesize

      80KB

    • memory/3032-117-0x000000000041F0E0-mapping.dmp
    • memory/3032-116-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/3140-128-0x0000000000000000-mapping.dmp