Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    13-11-2021 10:27

General

  • Target

    7a1b8316f5ab5e580a39374469dd8029949c791b6ac33627b3824868bd5aaf28.exe

  • Size

    315KB

  • MD5

    7d22b7632fc02e12438e7748eca086b4

  • SHA1

    e7e9f311c61a9aa1537053e96f9b8f5273c47dee

  • SHA256

    7a1b8316f5ab5e580a39374469dd8029949c791b6ac33627b3824868bd5aaf28

  • SHA512

    fdb1785372411642b8479bc54b83262a04cdc78fb4ca372fb6d81b0e0c876b06a3b83475a6d7d41f103bf4c2285bab08b67ce70bde6f4fef2d9f8c70b6cbad3f

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a1b8316f5ab5e580a39374469dd8029949c791b6ac33627b3824868bd5aaf28.exe
    "C:\Users\Admin\AppData\Local\Temp\7a1b8316f5ab5e580a39374469dd8029949c791b6ac33627b3824868bd5aaf28.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3160
    • C:\Users\Admin\AppData\Local\Temp\7a1b8316f5ab5e580a39374469dd8029949c791b6ac33627b3824868bd5aaf28.exe
      "C:\Users\Admin\AppData\Local\Temp\7a1b8316f5ab5e580a39374469dd8029949c791b6ac33627b3824868bd5aaf28.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3160-118-0x0000000000710000-0x0000000000711000-memory.dmp
    Filesize

    4KB

  • memory/3160-120-0x0000000005610000-0x0000000005611000-memory.dmp
    Filesize

    4KB

  • memory/3160-121-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
    Filesize

    4KB

  • memory/3160-122-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
    Filesize

    4KB

  • memory/3160-123-0x0000000004F40000-0x0000000004FD2000-memory.dmp
    Filesize

    584KB

  • memory/3160-124-0x00000000055F0000-0x00000000055F5000-memory.dmp
    Filesize

    20KB

  • memory/3160-125-0x00000000073D0000-0x00000000073D1000-memory.dmp
    Filesize

    4KB

  • memory/3160-126-0x0000000006DE0000-0x0000000006E2A000-memory.dmp
    Filesize

    296KB

  • memory/3904-127-0x0000000000400000-0x000000000042E000-memory.dmp
    Filesize

    184KB

  • memory/3904-128-0x000000000041EB80-mapping.dmp
  • memory/3904-129-0x00000000018D0000-0x0000000001BF0000-memory.dmp
    Filesize

    3.1MB