Analysis
- max time kernel
149s - max time network
153s - platform
windows7_x64 - resource
win7-20220414-en - submitted
27/06/2022, 07:50
General
- Target DEKONT.exe
- Size 476KB
- Sample220627-jpac9sbfb5
- SHA256 67edbb99d3aba4abdd5edb3151171935ac1ceb730fd3227da79c33e3b2ab03c9
Malware Config
Extracted
-
formbook
-
4.1
-
g3t1
-
369manifestwealth.com
-
centralfloridadecking.com
-
wareadvance.com
-
hellobody.net
-
housemaker.pro
-
kudoki.net
-
peakadventures.net
-
liquidscreeds.world
-
corebenefitsconsultantsllc.com
-
housecondonow.com
-
xn--ah-kta.com
-
evolv3-consulting.com
-
78688653.com
-
truthvanguard.com
-
locarte.online
-
eighthoursandchange.com
-
polskebojnom.xyz
-
quaypottery.com
-
raintechsg.com
-
westpac-cancel.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 4 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DEKONT.exe"C:\Users\Admin\AppData\Local\Temp\DEKONT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
yak (20).ico
memory/524-73-0x00000000020E0000-0x00000000023E3000-memory.dmp
memory/524-72-0x0000000000080000-0x00000000000AF000-memory.dmp
memory/524-76-0x0000000000080000-0x00000000000AF000-memory.dmp
memory/524-74-0x0000000002490000-0x0000000002523000-memory.dmp
memory/524-71-0x0000000000450000-0x0000000000554000-memory.dmp
memory/892-54-0x0000000000140000-0x00000000001BE000-memory.dmp
memory/892-55-0x0000000075441000-0x0000000075443000-memory.dmp
memory/1392-77-0x00000000062A0000-0x0000000006340000-memory.dmp
memory/1392-75-0x00000000062A0000-0x0000000006340000-memory.dmp
memory/1392-66-0x0000000006B60000-0x0000000006C6F000-memory.dmp
memory/1648-61-0x0000000000180000-0x00000000001AF000-memory.dmp
memory/1648-64-0x0000000000AD0000-0x0000000000DD3000-memory.dmp
memory/1648-57-0x0000000000180000-0x00000000001AF000-memory.dmp
memory/1648-59-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1648-56-0x0000000000180000-0x00000000001AF000-memory.dmp
memory/1648-65-0x00000000002C0000-0x00000000002D4000-memory.dmp