Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-08-2022 07:00

General

  • Target

    RE,RE,PURCHASE ORDER-9608.exe

  • Size

    674KB

  • MD5

    117d07e25f9ad2a77c83bb10295d55b3

  • SHA1

    d96ccb10d93cc2b6dee5482459a9602762ad2a91

  • SHA256

    3267b1eb2ba481661c36673fd9ece9d49a3e6ebe215ec02210fac50673cad1be

  • SHA512

    b3f4dcb83bba06da043aedd894faf9e79c7921f82f845526edf5664af2f0cb0bfcf499775f27ed719785c436362e60404c722a195bf5579adb39129ca6ab04e6

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Users\Admin\AppData\Local\Temp\RE,RE,PURCHASE ORDER-9608.exe
      "C:\Users\Admin\AppData\Local\Temp\RE,RE,PURCHASE ORDER-9608.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3388
      • C:\Users\Admin\AppData\Local\Temp\RE,RE,PURCHASE ORDER-9608.exe
        "C:\Users\Admin\AppData\Local\Temp\RE,RE,PURCHASE ORDER-9608.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4872
    • C:\Windows\SysWOW64\help.exe
      "C:\Windows\SysWOW64\help.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1656
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\RE,RE,PURCHASE ORDER-9608.exe"
        3⤵
          PID:3068

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1656-144-0x0000000000000000-mapping.dmp
    • memory/1656-152-0x0000000001220000-0x000000000124F000-memory.dmp
      Filesize

      188KB

    • memory/1656-150-0x0000000001BF0000-0x0000000001C84000-memory.dmp
      Filesize

      592KB

    • memory/1656-149-0x0000000001220000-0x000000000124F000-memory.dmp
      Filesize

      188KB

    • memory/1656-148-0x00000000018A0000-0x0000000001BEA000-memory.dmp
      Filesize

      3.3MB

    • memory/1656-147-0x0000000000930000-0x0000000000937000-memory.dmp
      Filesize

      28KB

    • memory/2640-143-0x00000000091B0000-0x0000000009339000-memory.dmp
      Filesize

      1.5MB

    • memory/2640-153-0x0000000008680000-0x000000000878A000-memory.dmp
      Filesize

      1.0MB

    • memory/2640-151-0x0000000008680000-0x000000000878A000-memory.dmp
      Filesize

      1.0MB

    • memory/3068-146-0x0000000000000000-mapping.dmp
    • memory/3388-132-0x0000000000F10000-0x0000000000FBE000-memory.dmp
      Filesize

      696KB

    • memory/3388-137-0x000000000BA80000-0x000000000BAE6000-memory.dmp
      Filesize

      408KB

    • memory/3388-136-0x000000000B9E0000-0x000000000BA7C000-memory.dmp
      Filesize

      624KB

    • memory/3388-135-0x0000000003500000-0x000000000350A000-memory.dmp
      Filesize

      40KB

    • memory/3388-134-0x0000000005960000-0x00000000059F2000-memory.dmp
      Filesize

      584KB

    • memory/3388-133-0x0000000006060000-0x0000000006604000-memory.dmp
      Filesize

      5.6MB

    • memory/4872-138-0x0000000000000000-mapping.dmp
    • memory/4872-145-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4872-139-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4872-142-0x0000000001380000-0x0000000001395000-memory.dmp
      Filesize

      84KB

    • memory/4872-141-0x00000000013A0000-0x00000000016EA000-memory.dmp
      Filesize

      3.3MB