Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    13-10-2021 01:40

General

  • Target

    0cf11de8a0ce67a46203ae419f2aa7bb988ae3088dc4f33158dccc55b97e4a7d.exe

  • Size

    605KB

  • MD5

    7b57c26a8208756f37e8df8331f94610

  • SHA1

    bfb4a9e25f36ade44b084706da30c3f305d65609

  • SHA256

    0cf11de8a0ce67a46203ae419f2aa7bb988ae3088dc4f33158dccc55b97e4a7d

  • SHA512

    28aa1f10114bec29af3b55aaa17146f5f7daf6814891269c06545a0627bcedf19130b7e5454f2cbdf370525b272e2e6d6ec04c09bcc540903c482e4473025b7f

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0cf11de8a0ce67a46203ae419f2aa7bb988ae3088dc4f33158dccc55b97e4a7d.exe
    "C:\Users\Admin\AppData\Local\Temp\0cf11de8a0ce67a46203ae419f2aa7bb988ae3088dc4f33158dccc55b97e4a7d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Users\Admin\AppData\Local\Temp\0cf11de8a0ce67a46203ae419f2aa7bb988ae3088dc4f33158dccc55b97e4a7d.exe
      "C:\Users\Admin\AppData\Local\Temp\0cf11de8a0ce67a46203ae419f2aa7bb988ae3088dc4f33158dccc55b97e4a7d.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1688-115-0x0000000000340000-0x0000000000341000-memory.dmp
    Filesize

    4KB

  • memory/1688-117-0x0000000005180000-0x0000000005181000-memory.dmp
    Filesize

    4KB

  • memory/1688-118-0x0000000004C80000-0x0000000004C81000-memory.dmp
    Filesize

    4KB

  • memory/1688-119-0x0000000004C30000-0x0000000004C31000-memory.dmp
    Filesize

    4KB

  • memory/1688-120-0x0000000004C00000-0x0000000004C01000-memory.dmp
    Filesize

    4KB

  • memory/1688-121-0x0000000005160000-0x0000000005165000-memory.dmp
    Filesize

    20KB

  • memory/1688-122-0x0000000007030000-0x0000000007031000-memory.dmp
    Filesize

    4KB

  • memory/1688-123-0x0000000007150000-0x00000000071C4000-memory.dmp
    Filesize

    464KB

  • memory/2852-124-0x0000000000400000-0x000000000042E000-memory.dmp
    Filesize

    184KB

  • memory/2852-125-0x000000000041EB80-mapping.dmp
  • memory/2852-126-0x0000000000FF0000-0x0000000001310000-memory.dmp
    Filesize

    3.1MB