Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11-05-2023 13:31

General

  • Target

    NEW PURCHASE ORDER MAY 00957585.exe

  • Size

    704KB

  • MD5

    811027b8823ce068fa572fd1e782b126

  • SHA1

    0ea06503dd9e0bb2946b2b600746a22a9c489bfc

  • SHA256

    90315c352a9820703d29e4dcd9360660dd23bbfac585030993404076b998e45c

  • SHA512

    6cae36f495db62bc8b337797e00a2288f3bab8bd1ae5a71c48f972a653090e641eb015ef891c03325013d19af8ccbc50ef47aea1923d1afc0207cb17c9f86d01

  • SSDEEP

    12288:fvmbfOJWMnslt0uWDGRQjKyZnutU3UODbOJ0xHSTm/K4dHmNhdm:XmbfOnsltPWyRQjhZutGnGywTmS4s

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe
      "C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe
        "C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2312
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER MAY 00957585.exe"
        3⤵
          PID:2840

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1916-121-0x0000000000EF0000-0x0000000000FA6000-memory.dmp
      Filesize

      728KB

    • memory/1916-122-0x0000000005E30000-0x000000000632E000-memory.dmp
      Filesize

      5.0MB

    • memory/1916-123-0x0000000005930000-0x00000000059C2000-memory.dmp
      Filesize

      584KB

    • memory/1916-124-0x0000000005910000-0x000000000591A000-memory.dmp
      Filesize

      40KB

    • memory/1916-125-0x0000000005B80000-0x0000000005B90000-memory.dmp
      Filesize

      64KB

    • memory/1916-126-0x0000000008760000-0x0000000008772000-memory.dmp
      Filesize

      72KB

    • memory/1916-127-0x0000000005B80000-0x0000000005B90000-memory.dmp
      Filesize

      64KB

    • memory/1916-128-0x00000000089F0000-0x00000000089FA000-memory.dmp
      Filesize

      40KB

    • memory/1916-129-0x0000000008D00000-0x0000000008D8C000-memory.dmp
      Filesize

      560KB

    • memory/1916-130-0x0000000008E30000-0x0000000008ECC000-memory.dmp
      Filesize

      624KB

    • memory/1916-131-0x0000000008DD0000-0x0000000008E24000-memory.dmp
      Filesize

      336KB

    • memory/2312-135-0x0000000001900000-0x0000000001C20000-memory.dmp
      Filesize

      3.1MB

    • memory/2312-140-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/2312-136-0x00000000013D0000-0x00000000013E5000-memory.dmp
      Filesize

      84KB

    • memory/2312-132-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/2592-143-0x0000000000CB0000-0x0000000000CCF000-memory.dmp
      Filesize

      124KB

    • memory/2592-141-0x0000000000CB0000-0x0000000000CCF000-memory.dmp
      Filesize

      124KB

    • memory/2592-138-0x0000000000CB0000-0x0000000000CCF000-memory.dmp
      Filesize

      124KB

    • memory/2592-145-0x0000000004E50000-0x0000000005170000-memory.dmp
      Filesize

      3.1MB

    • memory/2592-144-0x0000000003070000-0x000000000309F000-memory.dmp
      Filesize

      188KB

    • memory/2592-146-0x0000000003070000-0x000000000309F000-memory.dmp
      Filesize

      188KB

    • memory/2592-148-0x0000000004DA0000-0x0000000004E34000-memory.dmp
      Filesize

      592KB

    • memory/3176-137-0x00000000055E0000-0x0000000005728000-memory.dmp
      Filesize

      1.3MB

    • memory/3176-149-0x0000000001090000-0x0000000001177000-memory.dmp
      Filesize

      924KB

    • memory/3176-150-0x0000000001090000-0x0000000001177000-memory.dmp
      Filesize

      924KB

    • memory/3176-152-0x0000000001090000-0x0000000001177000-memory.dmp
      Filesize

      924KB