Analysis

  • max time kernel
    76s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    20-10-2021 07:24

General

  • Target

    c78d5e89ebecb4d88d3ab36bc47fd7ba.exe

  • Size

    448KB

  • MD5

    c78d5e89ebecb4d88d3ab36bc47fd7ba

  • SHA1

    476733e0eb88a9dce2a65200c23ddd0d5f2b3496

  • SHA256

    9b6b00b331ea48d5477fbd0ec6e168407dcec59c758eb797c9672d2f74dba12a

  • SHA512

    a4de582e5f599ad11c60dbdb7e7ded18c004f956ec84eb379f30ebd1e83eb3fe938fab821038dcf6c1dff839b329ff85ab556fd75f54e70e332ff25415ddfddb

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c78d5e89ebecb4d88d3ab36bc47fd7ba.exe
    "C:\Users\Admin\AppData\Local\Temp\c78d5e89ebecb4d88d3ab36bc47fd7ba.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3600
    • C:\Users\Admin\AppData\Local\Temp\c78d5e89ebecb4d88d3ab36bc47fd7ba.exe
      "C:\Users\Admin\AppData\Local\Temp\c78d5e89ebecb4d88d3ab36bc47fd7ba.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2916-125-0x000000000041EB80-mapping.dmp
  • memory/2916-124-0x0000000000400000-0x000000000042E000-memory.dmp
    Filesize

    184KB

  • memory/2916-126-0x0000000001320000-0x0000000001640000-memory.dmp
    Filesize

    3.1MB

  • memory/3600-115-0x0000000000E60000-0x0000000000E61000-memory.dmp
    Filesize

    4KB

  • memory/3600-117-0x0000000008120000-0x0000000008121000-memory.dmp
    Filesize

    4KB

  • memory/3600-118-0x0000000007C20000-0x0000000007C21000-memory.dmp
    Filesize

    4KB

  • memory/3600-119-0x0000000005870000-0x0000000005871000-memory.dmp
    Filesize

    4KB

  • memory/3600-120-0x0000000005850000-0x0000000005851000-memory.dmp
    Filesize

    4KB

  • memory/3600-121-0x0000000007FE0000-0x0000000007FE7000-memory.dmp
    Filesize

    28KB

  • memory/3600-122-0x0000000009800000-0x0000000009801000-memory.dmp
    Filesize

    4KB

  • memory/3600-123-0x00000000097B0000-0x00000000097FF000-memory.dmp
    Filesize

    316KB