Analysis
-
max time kernel
255s -
max time network
324s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
08-12-2022 13:31
General
-
Target
HA-22-2819922-077.exe
-
Size
551KB
-
MD5
f3fa21b3a4822c327047bf6937862210
-
SHA1
39d943eb69e2823d90544c259faff8097e0337ce
-
SHA256
bd4e6d059703f5a320f62a2db4c3b89e6c1878f0be17c06c494f0c1328fd1c50
-
SHA512
e66cf4dc486aa340f593d3354caa5636550fd7cfb0ba16e4a41db4411b3546b787b43e673a8356a75859805e2a73a0e7f6b4256eaa61f6049aef5db3075293d5
-
SSDEEP
12288:JuN7XJPGa/5LplH5PN3r86eXEONa9iJ8jr4H:Juj+4zZO6Qnyn
Malware Config
Extracted
formbook
4.1
urde
belleriacortland.com
gxzyykx.com
blocksholding.net
zhangjiyuan.com
tyfinck.com
xn--v9s.club
xn--72c9at8ec1l.com
dorismart.online
nocodeuni.com
hmmprocesos.website
quartile.agency
iansdogname.com
karengillen.com
the-bitindexprime.info
nthanisolutions.com
nakamu.online
sahityanepal.com
sinwinindustry.com
shotblastwearingparts.com
nstsuccess.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 2 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HA-22-2819922-077.exe"C:\Users\Admin\AppData\Local\Temp\HA-22-2819922-077.exe"1⤵
- Sets service image path in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
-
-
Filesize
568KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB