Overview

overview

10

Static

static

REVISED_.EXE.exe

windows7-x64

10

REVISED_.EXE.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2023, 08:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    REVISED_.EXE.exe
  • Size 761KB
  • Sample230202-j6958afe83
  • SHA256 ed5c5ef5186a78d9dd02e7dbf36b0bcc9d6c0e733f04a6780f6bcf06dbfc3338
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookgg62ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • gg62

Decoy

  • growfast.africa

  • lerema.com

  • 38945.se

  • wheelfermotors.africa

  • giftshareforyou.online

  • burrismktg.com

  • keepgrowing.uk

  • efefhomeless.buzz

  • bryanokoh.com

  • fashion-clothing-40094.com

  • andreasunshine.com

  • naijahood.africa

  • aditrirealty.com

  • kinnoitodatsumou.com

  • cryptoqzclimax.com

  • hairly.biz

  • comeuphither4.com

  • integrity360.ltd

  • flushywhole.com

  • 8869365.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook payload 4 IoCs
    rat
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe
      "C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2236
      • C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe
        "C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3644
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4140
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe"
        3⤵
          PID:3392

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/2164-143-0x0000000007FF0000-0x0000000008127000-memory.dmp
          Download

          memory/2164-152-0x0000000008130000-0x00000000081D0000-memory.dmp
          Download

          memory/2164-150-0x0000000008130000-0x00000000081D0000-memory.dmp
          Download

          memory/2236-133-0x0000000005920000-0x0000000005EC4000-memory.dmp
          Download

          memory/2236-134-0x0000000005410000-0x00000000054A2000-memory.dmp
          Download

          memory/2236-135-0x00000000053D0000-0x00000000053DA000-memory.dmp
          Download

          memory/2236-136-0x0000000008EF0000-0x0000000008F8C000-memory.dmp
          Download

          memory/2236-132-0x0000000000A90000-0x0000000000B54000-memory.dmp
          Download

          memory/3644-142-0x0000000001A00000-0x0000000001A14000-memory.dmp
          Download

          memory/3644-141-0x0000000001A60000-0x0000000001DAA000-memory.dmp
          Download

          memory/3644-140-0x0000000000400000-0x000000000042F000-memory.dmp
          Download

          memory/3644-138-0x0000000000400000-0x000000000042F000-memory.dmp
          Download

          memory/4140-145-0x0000000000250000-0x0000000000683000-memory.dmp
          Download

          memory/4140-146-0x0000000000C10000-0x0000000000C3F000-memory.dmp
          Download

          memory/4140-148-0x0000000002D50000-0x000000000309A000-memory.dmp
          Download

          memory/4140-149-0x0000000002A90000-0x0000000002B23000-memory.dmp
          Download

          memory/4140-151-0x0000000000C10000-0x0000000000C3F000-memory.dmp
          Download