Analysis

  • max time kernel
    42s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    24-05-2022 18:29

General

  • Target

    4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe

  • Size

    280KB

  • MD5

    12fb37f122adb02ce6d17aeb436111f9

  • SHA1

    2e0a8d604227d8c24b1bdebb53d321c40a9fc4a2

  • SHA256

    4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c

  • SHA512

    cb8d0ec715609f8fb207c15079c0ecbab7023c9956727bed40678547a1325988994c2c1b2b6535422d86f75829a831ff20c96b1a639006f2059c43edba4902f1

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

q5e

Decoy

2177.ltd

thanxiety.com

max-width.com

fixti.net

mostmaj.com

mobilteknolojiuzmani.com

historyannals.com

wheelchairmotion.com

mossandmoonstonestudio.com

kastellifournis.com

axokey.net

peekl.com

metsteeshirt.com

abcfinancial-inc.com

btxrsp.com

amydh.com

ccoauthority.com

lumacorretora.com

kimfelixrealtor.com

iconext.biz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe
    "C:\Users\Admin\AppData\Local\Temp\4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 104
      2⤵
      • Program crash
      PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/904-54-0x000000000051E000-0x0000000000565000-memory.dmp
    Filesize

    284KB

  • memory/904-55-0x000000000052F000-0x000000000055D000-memory.dmp
    Filesize

    184KB

  • memory/904-56-0x0000000002350000-0x0000000002653000-memory.dmp
    Filesize

    3.0MB

  • memory/1976-57-0x0000000000000000-mapping.dmp