Analysis

  • max time kernel
    151s
  • max time network
    176s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05-05-2023 19:05

General

  • Target

    Havells New Order.exe

  • Size

    699KB

  • MD5

    300d31029b8682f365329877661a178f

  • SHA1

    aafcc7ef5558fc23613b712eb84d527a00d0b301

  • SHA256

    5165efed390a7710ab87e8256f51ec07dbc9b63e8cf55e104a9230530b813cb0

  • SHA512

    33e3df0de9def64289838c135b174e6cc9bee44fd729363a2baed45301a48641d0f0d9b7d64cac4e54dece1fbfc9753a8e277d1219ae73cb318df6d1c4e1f501

  • SSDEEP

    12288:qPKQH/WQn0L3PCy5lukBLuS45UF1U7+QPM2YvzM0hga6zku7f:IKQfWS07Cy5wCLUWU7+Q6vzM0Igur

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe
      "C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe
        "C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1168
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:828
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"
        3⤵
        • Deletes itself
        PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/828-71-0x0000000000D80000-0x0000000000DA6000-memory.dmp
    Filesize

    152KB

  • memory/828-77-0x0000000000B30000-0x0000000000BC4000-memory.dmp
    Filesize

    592KB

  • memory/828-75-0x0000000000070000-0x000000000009F000-memory.dmp
    Filesize

    188KB

  • memory/828-74-0x00000000021B0000-0x00000000024B3000-memory.dmp
    Filesize

    3.0MB

  • memory/828-73-0x0000000000070000-0x000000000009F000-memory.dmp
    Filesize

    188KB

  • memory/828-72-0x0000000000D80000-0x0000000000DA6000-memory.dmp
    Filesize

    152KB

  • memory/1168-67-0x0000000000D30000-0x0000000001033000-memory.dmp
    Filesize

    3.0MB

  • memory/1168-68-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1168-62-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1168-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
    Filesize

    4KB

  • memory/1168-64-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1168-61-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1168-69-0x0000000000140000-0x0000000000155000-memory.dmp
    Filesize

    84KB

  • memory/1264-70-0x00000000073F0000-0x0000000007569000-memory.dmp
    Filesize

    1.5MB

  • memory/1264-66-0x0000000003970000-0x0000000003A70000-memory.dmp
    Filesize

    1024KB

  • memory/1264-78-0x0000000006C90000-0x0000000006D9C000-memory.dmp
    Filesize

    1.0MB

  • memory/1264-79-0x0000000006C90000-0x0000000006D9C000-memory.dmp
    Filesize

    1.0MB

  • memory/1264-81-0x0000000006C90000-0x0000000006D9C000-memory.dmp
    Filesize

    1.0MB

  • memory/2008-54-0x0000000000C70000-0x0000000000D26000-memory.dmp
    Filesize

    728KB

  • memory/2008-60-0x00000000049B0000-0x00000000049F6000-memory.dmp
    Filesize

    280KB

  • memory/2008-59-0x00000000059D0000-0x0000000005A4E000-memory.dmp
    Filesize

    504KB

  • memory/2008-58-0x0000000000580000-0x000000000058C000-memory.dmp
    Filesize

    48KB

  • memory/2008-57-0x00000000047F0000-0x0000000004830000-memory.dmp
    Filesize

    256KB

  • memory/2008-56-0x0000000000510000-0x0000000000520000-memory.dmp
    Filesize

    64KB

  • memory/2008-55-0x00000000047F0000-0x0000000004830000-memory.dmp
    Filesize

    256KB