Analysis

  • max time kernel
    148s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2023 19:06

General

  • Target

    Havells New Order.exe

  • Size

    699KB

  • MD5

    300d31029b8682f365329877661a178f

  • SHA1

    aafcc7ef5558fc23613b712eb84d527a00d0b301

  • SHA256

    5165efed390a7710ab87e8256f51ec07dbc9b63e8cf55e104a9230530b813cb0

  • SHA512

    33e3df0de9def64289838c135b174e6cc9bee44fd729363a2baed45301a48641d0f0d9b7d64cac4e54dece1fbfc9753a8e277d1219ae73cb318df6d1c4e1f501

  • SSDEEP

    12288:qPKQH/WQn0L3PCy5lukBLuS45UF1U7+QPM2YvzM0hga6zku7f:IKQfWS07Cy5wCLUWU7+Q6vzM0Igur

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 5 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe
      "C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4128
      • C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe
        "C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:716
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:3104
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3272
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"
          3⤵
            PID:2500

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/716-146-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/716-150-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/716-147-0x0000000001590000-0x00000000015A5000-memory.dmp
        Filesize

        84KB

      • memory/716-140-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/716-142-0x0000000001620000-0x000000000196A000-memory.dmp
        Filesize

        3.3MB

      • memory/716-144-0x0000000001510000-0x0000000001525000-memory.dmp
        Filesize

        84KB

      • memory/3168-163-0x00000000078E0000-0x00000000079B8000-memory.dmp
        Filesize

        864KB

      • memory/3168-161-0x00000000078E0000-0x00000000079B8000-memory.dmp
        Filesize

        864KB

      • memory/3168-160-0x00000000078E0000-0x00000000079B8000-memory.dmp
        Filesize

        864KB

      • memory/3168-148-0x0000000003310000-0x0000000003400000-memory.dmp
        Filesize

        960KB

      • memory/3168-145-0x0000000008B00000-0x0000000008C69000-memory.dmp
        Filesize

        1.4MB

      • memory/3272-154-0x00000000006B0000-0x00000000006C2000-memory.dmp
        Filesize

        72KB

      • memory/3272-156-0x0000000002490000-0x00000000027DA000-memory.dmp
        Filesize

        3.3MB

      • memory/3272-159-0x00000000022D0000-0x0000000002364000-memory.dmp
        Filesize

        592KB

      • memory/3272-149-0x00000000006B0000-0x00000000006C2000-memory.dmp
        Filesize

        72KB

      • memory/3272-157-0x0000000000430000-0x000000000045F000-memory.dmp
        Filesize

        188KB

      • memory/3272-152-0x00000000006B0000-0x00000000006C2000-memory.dmp
        Filesize

        72KB

      • memory/3272-155-0x0000000000430000-0x000000000045F000-memory.dmp
        Filesize

        188KB

      • memory/4128-137-0x0000000005A60000-0x0000000005A6A000-memory.dmp
        Filesize

        40KB

      • memory/4128-133-0x0000000000A10000-0x0000000000AC6000-memory.dmp
        Filesize

        728KB

      • memory/4128-139-0x0000000007A00000-0x0000000007A9C000-memory.dmp
        Filesize

        624KB

      • memory/4128-138-0x00000000054C0000-0x00000000054D0000-memory.dmp
        Filesize

        64KB

      • memory/4128-136-0x00000000054C0000-0x00000000054D0000-memory.dmp
        Filesize

        64KB

      • memory/4128-135-0x00000000054E0000-0x0000000005572000-memory.dmp
        Filesize

        584KB

      • memory/4128-134-0x0000000005A90000-0x0000000006034000-memory.dmp
        Filesize

        5.6MB