Analysis

  • max time kernel
    65s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    16-01-2023 22:54

General

  • Target

    6670643884f45c79ebf03330570074899755e1f3902d7c08316ecbde4f57efa4.exe

  • Size

    802KB

  • MD5

    39f359057dcc83f648f4c664a65be4ef

  • SHA1

    64717e87bd70f1ed083332d88e38b4de57ef7c2c

  • SHA256

    6670643884f45c79ebf03330570074899755e1f3902d7c08316ecbde4f57efa4

  • SHA512

    066b5a1d93efaffec37111d4b69146c1e764513f6d557f1ff837439c6a674ddc29b924b67f560890916d9a5a141a719486433525f0c7b1388fc5f3b979ea2a3f

  • SSDEEP

    12288:88v+rEo6SolylSx1XqqXaCZSXBcPp/5dCtqKflsNEfrTmFio0NPoR55KFe:TpJadkpTCtqHaoOoR5E

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6670643884f45c79ebf03330570074899755e1f3902d7c08316ecbde4f57efa4.exe
    "C:\Users\Admin\AppData\Local\Temp\6670643884f45c79ebf03330570074899755e1f3902d7c08316ecbde4f57efa4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Users\Admin\AppData\Local\Temp\6670643884f45c79ebf03330570074899755e1f3902d7c08316ecbde4f57efa4.exe
      "{path}"
      2⤵
        PID:952
      • C:\Users\Admin\AppData\Local\Temp\6670643884f45c79ebf03330570074899755e1f3902d7c08316ecbde4f57efa4.exe
        "{path}"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:672

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/672-59-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/672-60-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/672-62-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/672-63-0x000000000041F020-mapping.dmp
    • memory/672-64-0x0000000000C60000-0x0000000000F63000-memory.dmp
      Filesize

      3.0MB

    • memory/1952-54-0x0000000000A00000-0x0000000000ACE000-memory.dmp
      Filesize

      824KB

    • memory/1952-55-0x00000000750A1000-0x00000000750A3000-memory.dmp
      Filesize

      8KB

    • memory/1952-56-0x00000000001C0000-0x00000000001E0000-memory.dmp
      Filesize

      128KB

    • memory/1952-57-0x00000000051F0000-0x0000000005274000-memory.dmp
      Filesize

      528KB

    • memory/1952-58-0x0000000000550000-0x0000000000584000-memory.dmp
      Filesize

      208KB