Analysis

  • max time kernel
    43s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    22-06-2023 07:57

General

  • Target

    98f77c40ece5a0af4f1a4597ab414fda.exe

  • Size

    715KB

  • MD5

    98f77c40ece5a0af4f1a4597ab414fda

  • SHA1

    08e01cd1e38e764d508097ac6cf4aa401f432dae

  • SHA256

    4faf527fcde9f38b487c5f4a7c29dcba98977f664c1f2c8be13bc88c7232f496

  • SHA512

    62bafb8b9701b13934675249f184e413e8dae43cd10e359c610af1f3c903941b1c291858df0a60292c5d0f059a206b15df15d855f4fc78b7cd84c1f5c2076b32

  • SSDEEP

    12288:k9PM7q6bpw4dcZda/igiO/fY68YwdxY8TWStwnDlxgoM6HEykHUAaa3bDXB:zzu4CZdONfV8YwLY8C3lxgoM6HRk0ADx

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xchu

Decoy

zcartoons.com

castilloshowroom.com

3bmmdtod.life

misaxoxo.com

nadiya.online

sykkbup29.xyz

triciaaprimrosevp.com

newleter.com

ptzslk.xyz

lightbulbfestival.com

texaslandline.com

ideeintemporelle.com

girljustdoitpodcast.com

medimediamarketing.com

bunk7outfitters.com

charlievgrfminnick.click

lifestyleinthehome.com

atfbestsale.online

frontdoorproperties.co.uk

grandpaswag2024.info

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\98f77c40ece5a0af4f1a4597ab414fda.exe
    "C:\Users\Admin\AppData\Local\Temp\98f77c40ece5a0af4f1a4597ab414fda.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Users\Admin\AppData\Local\Temp\98f77c40ece5a0af4f1a4597ab414fda.exe
      "C:\Users\Admin\AppData\Local\Temp\98f77c40ece5a0af4f1a4597ab414fda.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1456-61-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1456-62-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1456-64-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1456-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
    Filesize

    4KB

  • memory/1456-65-0x0000000000840000-0x0000000000B43000-memory.dmp
    Filesize

    3.0MB

  • memory/1628-54-0x00000000010D0000-0x0000000001188000-memory.dmp
    Filesize

    736KB

  • memory/1628-55-0x0000000004DA0000-0x0000000004DE0000-memory.dmp
    Filesize

    256KB

  • memory/1628-56-0x0000000000920000-0x0000000000934000-memory.dmp
    Filesize

    80KB

  • memory/1628-57-0x0000000004DA0000-0x0000000004DE0000-memory.dmp
    Filesize

    256KB

  • memory/1628-58-0x0000000000400000-0x000000000040C000-memory.dmp
    Filesize

    48KB

  • memory/1628-59-0x00000000057C0000-0x0000000005830000-memory.dmp
    Filesize

    448KB

  • memory/1628-60-0x0000000000D30000-0x0000000000D68000-memory.dmp
    Filesize

    224KB