Analysis

  • max time kernel
    119s
  • max time network
    127s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    13-11-2021 10:58

General

  • Target

    8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe

  • Size

    329KB

  • MD5

    1ad9efcddab819d24cca2f9323395f9e

  • SHA1

    1ffcdd188cb66666cdac14bb8d8b48902bd666e6

  • SHA256

    8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653

  • SHA512

    1afaa2924ef06a5cde9cc1778b892738c126a3311c59e407a931601f5459ec26b7348ed12832cc88399931540d5198407be1c28f4ec7c3d1b98f70ebf15a8046

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    "C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3676
    • C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
      "C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe"
      2⤵
        PID:436
      • C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
        "C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:744

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/744-127-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/744-128-0x000000000041EB80-mapping.dmp
    • memory/744-129-0x00000000010C0000-0x00000000013E0000-memory.dmp
      Filesize

      3.1MB

    • memory/3676-118-0x0000000000F80000-0x0000000000F81000-memory.dmp
      Filesize

      4KB

    • memory/3676-120-0x0000000005E90000-0x0000000005E91000-memory.dmp
      Filesize

      4KB

    • memory/3676-121-0x0000000005880000-0x0000000005881000-memory.dmp
      Filesize

      4KB

    • memory/3676-122-0x0000000003340000-0x0000000003341000-memory.dmp
      Filesize

      4KB

    • memory/3676-123-0x0000000005810000-0x0000000005811000-memory.dmp
      Filesize

      4KB

    • memory/3676-124-0x0000000005AB0000-0x0000000005AB7000-memory.dmp
      Filesize

      28KB

    • memory/3676-125-0x0000000007FC0000-0x0000000007FC1000-memory.dmp
      Filesize

      4KB

    • memory/3676-126-0x0000000007F70000-0x0000000007FBB000-memory.dmp
      Filesize

      300KB