Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
18/05/2023, 01:56
General
-
Target
rocee6632.exe
-
Size
264KB
-
MD5
49490781256eb385d2331df5a69dc140
-
SHA1
8d4c961f6c10bda804b5d29923f937848f0c6915
-
SHA256
541e5e1932882d5833cbc39c7ab81d4faeba4a9fe4b915530be3533d0269cc99
-
SHA512
8bccf328813842e72688295438b38e080ffc2a8b39ac2349c29611616398f2aa2e3832ce7ca6368bea5b2d5890f5d598906bcf1e95d8dc89e3dd48fee3d69c6a
-
SSDEEP
6144:/Ya6+/+2b3/J5PMIId8xUCpdlHcrm4WqmxHppCXk:/YonnW8ye7HOm3qmxJpCXk
Malware Config
Extracted
formbook
4.1
re29
barnstorm-music.com
gazzettadellapuglia.com
baratieistore.space
cdrjdkj.com
carlissablog.com
langlalang.com
2886365.com
aq993.cyou
jwjwjwjw.com
car-deals-80304.com
dikevolesas.info
buycialistablets.online
theplantgranny.net
detoxshopbr.store
imans.biz
fightingcock.co.uk
loveforfurbabies.com
eastcoastbeveragegroup.com
alaaeldinsoft.com
microshel.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 4 IoCs
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rocee6632.exe"C:\Users\Admin\AppData\Local\Temp\rocee6632.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mifiql.exe"C:\Users\Admin\AppData\Local\Temp\mifiql.exe" C:\Users\Admin\AppData\Local\Temp\uusyrwwz.m3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mifiql.exe"C:\Users\Admin\AppData\Local\Temp\mifiql.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mifiql.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5c80b76a6454ea2f6cdb3cf3222203fd6
SHA179451e95ed94e93da85101aa7e827aed56550c5f
SHA256f73b99f99d23baab51f2d1d818ed33e756713676e58c72c1cd84b041a995cdf6
SHA5126b58d73be1c9d82ffeb4b2dbbd513fc494305258c9361c94b963ba660ad2d4c2d6ffd03ee0ecb530e93ae6ab0ec326ccbcdce844e33f86a89171e00f74b20a9b
-
Filesize
58KB
MD5c80b76a6454ea2f6cdb3cf3222203fd6
SHA179451e95ed94e93da85101aa7e827aed56550c5f
SHA256f73b99f99d23baab51f2d1d818ed33e756713676e58c72c1cd84b041a995cdf6
SHA5126b58d73be1c9d82ffeb4b2dbbd513fc494305258c9361c94b963ba660ad2d4c2d6ffd03ee0ecb530e93ae6ab0ec326ccbcdce844e33f86a89171e00f74b20a9b
-
Filesize
58KB
MD5c80b76a6454ea2f6cdb3cf3222203fd6
SHA179451e95ed94e93da85101aa7e827aed56550c5f
SHA256f73b99f99d23baab51f2d1d818ed33e756713676e58c72c1cd84b041a995cdf6
SHA5126b58d73be1c9d82ffeb4b2dbbd513fc494305258c9361c94b963ba660ad2d4c2d6ffd03ee0ecb530e93ae6ab0ec326ccbcdce844e33f86a89171e00f74b20a9b
-
Filesize
5KB
MD528e70e4e9a0b65459845b57f5befbdc3
SHA10a8a7797a508957d23d3bfab930f0958ceae9805
SHA256f9610af7a7b54bf034e9bf87ed40e60cfef654dddbb2bc5adef7fb8488e90b6f
SHA512d220ca2d5992d97d82c746316c81909f7219cff6fff60953ba0e38e166daf659b41de53d42748b56bf11431b29baa02060164f2a60f43938866bb8a5fd616df7
-
Filesize
205KB
MD5509941e9ba2b34496a5b4f233fb71cf5
SHA1e41d10dd73daeb059c4cbc8d83b719c9cdf35b86
SHA256253eef731b318281e1927411ed4bee189df63c94ba3e44241ef777bad47ca28a
SHA512aaad84393dbbd6397fd85b928c3c2cc20878f5b95395a4d1192f280fbf69146c4e4b09bc81fa099038a117a674c29a484e851875ae3017ad0008d72a89cbb05f
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
80KB
-
Filesize
188KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
880KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
188KB
-
Filesize
588KB