Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    15-08-2022 07:00

General

  • Target

    RE,RE,PURCHASE ORDER-9608.exe

  • Size

    674KB

  • MD5

    117d07e25f9ad2a77c83bb10295d55b3

  • SHA1

    d96ccb10d93cc2b6dee5482459a9602762ad2a91

  • SHA256

    3267b1eb2ba481661c36673fd9ece9d49a3e6ebe215ec02210fac50673cad1be

  • SHA512

    b3f4dcb83bba06da043aedd894faf9e79c7921f82f845526edf5664af2f0cb0bfcf499775f27ed719785c436362e60404c722a195bf5579adb39129ca6ab04e6

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 5 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\RE,RE,PURCHASE ORDER-9608.exe
      "C:\Users\Admin\AppData\Local\Temp\RE,RE,PURCHASE ORDER-9608.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1860
      • C:\Users\Admin\AppData\Local\Temp\RE,RE,PURCHASE ORDER-9608.exe
        "C:\Users\Admin\AppData\Local\Temp\RE,RE,PURCHASE ORDER-9608.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1380
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\SysWOW64\mstsc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1556
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\RE,RE,PURCHASE ORDER-9608.exe"
        3⤵
        • Deletes itself
        PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1192-69-0x0000000004D10000-0x0000000004E2E000-memory.dmp
    Filesize

    1.1MB

  • memory/1192-79-0x0000000004E30000-0x0000000004F65000-memory.dmp
    Filesize

    1.2MB

  • memory/1192-77-0x0000000004E30000-0x0000000004F65000-memory.dmp
    Filesize

    1.2MB

  • memory/1288-72-0x0000000000000000-mapping.dmp
  • memory/1380-66-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1380-67-0x0000000000910000-0x0000000000C13000-memory.dmp
    Filesize

    3.0MB

  • memory/1380-60-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1380-61-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1380-64-0x000000000041F020-mapping.dmp
  • memory/1380-63-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1380-68-0x0000000000220000-0x0000000000235000-memory.dmp
    Filesize

    84KB

  • memory/1556-74-0x0000000000080000-0x00000000000AF000-memory.dmp
    Filesize

    188KB

  • memory/1556-70-0x0000000000000000-mapping.dmp
  • memory/1556-73-0x0000000000B10000-0x0000000000C14000-memory.dmp
    Filesize

    1.0MB

  • memory/1556-75-0x00000000021B0000-0x00000000024B3000-memory.dmp
    Filesize

    3.0MB

  • memory/1556-76-0x0000000002020000-0x00000000020B4000-memory.dmp
    Filesize

    592KB

  • memory/1556-78-0x0000000000080000-0x00000000000AF000-memory.dmp
    Filesize

    188KB

  • memory/1860-54-0x00000000000D0000-0x000000000017E000-memory.dmp
    Filesize

    696KB

  • memory/1860-58-0x0000000005BE0000-0x0000000005C60000-memory.dmp
    Filesize

    512KB

  • memory/1860-57-0x0000000001FC0000-0x0000000001FCC000-memory.dmp
    Filesize

    48KB

  • memory/1860-59-0x00000000044C0000-0x0000000004500000-memory.dmp
    Filesize

    256KB

  • memory/1860-56-0x0000000001F90000-0x0000000001FB4000-memory.dmp
    Filesize

    144KB

  • memory/1860-55-0x0000000076761000-0x0000000076763000-memory.dmp
    Filesize

    8KB