Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-06-2023 13:20

General

  • Target

    03804099.exe

  • Size

    715KB

  • MD5

    98f77c40ece5a0af4f1a4597ab414fda

  • SHA1

    08e01cd1e38e764d508097ac6cf4aa401f432dae

  • SHA256

    4faf527fcde9f38b487c5f4a7c29dcba98977f664c1f2c8be13bc88c7232f496

  • SHA512

    62bafb8b9701b13934675249f184e413e8dae43cd10e359c610af1f3c903941b1c291858df0a60292c5d0f059a206b15df15d855f4fc78b7cd84c1f5c2076b32

  • SSDEEP

    12288:k9PM7q6bpw4dcZda/igiO/fY68YwdxY8TWStwnDlxgoM6HEykHUAaa3bDXB:zzu4CZdONfV8YwLY8C3lxgoM6HRk0ADx

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xchu

Decoy

zcartoons.com

castilloshowroom.com

3bmmdtod.life

misaxoxo.com

nadiya.online

sykkbup29.xyz

triciaaprimrosevp.com

newleter.com

ptzslk.xyz

lightbulbfestival.com

texaslandline.com

ideeintemporelle.com

girljustdoitpodcast.com

medimediamarketing.com

bunk7outfitters.com

charlievgrfminnick.click

lifestyleinthehome.com

atfbestsale.online

frontdoorproperties.co.uk

grandpaswag2024.info

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3184
    • C:\Users\Admin\AppData\Local\Temp\03804099.exe
      "C:\Users\Admin\AppData\Local\Temp\03804099.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3584
      • C:\Users\Admin\AppData\Local\Temp\03804099.exe
        "C:\Users\Admin\AppData\Local\Temp\03804099.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:868
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\SysWOW64\control.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\03804099.exe"
        3⤵
          PID:4280

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/868-140-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/868-147-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/868-144-0x0000000000B50000-0x0000000000B64000-memory.dmp
      Filesize

      80KB

    • memory/868-143-0x0000000001110000-0x000000000145A000-memory.dmp
      Filesize

      3.3MB

    • memory/3184-155-0x00000000086F0000-0x00000000087B9000-memory.dmp
      Filesize

      804KB

    • memory/3184-154-0x00000000086F0000-0x00000000087B9000-memory.dmp
      Filesize

      804KB

    • memory/3184-145-0x0000000002E80000-0x0000000002F79000-memory.dmp
      Filesize

      996KB

    • memory/3584-138-0x0000000005330000-0x0000000005340000-memory.dmp
      Filesize

      64KB

    • memory/3584-139-0x0000000006DD0000-0x0000000006E6C000-memory.dmp
      Filesize

      624KB

    • memory/3584-133-0x0000000000680000-0x0000000000738000-memory.dmp
      Filesize

      736KB

    • memory/3584-137-0x0000000005330000-0x0000000005340000-memory.dmp
      Filesize

      64KB

    • memory/3584-136-0x00000000050F0000-0x00000000050FA000-memory.dmp
      Filesize

      40KB

    • memory/3584-135-0x0000000005140000-0x00000000051D2000-memory.dmp
      Filesize

      584KB

    • memory/3584-134-0x00000000056F0000-0x0000000005C94000-memory.dmp
      Filesize

      5.6MB

    • memory/4264-148-0x0000000000E50000-0x0000000000E77000-memory.dmp
      Filesize

      156KB

    • memory/4264-146-0x0000000000E50000-0x0000000000E77000-memory.dmp
      Filesize

      156KB

    • memory/4264-149-0x0000000000B10000-0x0000000000B3F000-memory.dmp
      Filesize

      188KB

    • memory/4264-150-0x0000000002CD0000-0x000000000301A000-memory.dmp
      Filesize

      3.3MB

    • memory/4264-151-0x0000000000B10000-0x0000000000B3F000-memory.dmp
      Filesize

      188KB

    • memory/4264-153-0x0000000002B30000-0x0000000002BC3000-memory.dmp
      Filesize

      588KB