Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2023 08:46

General

  • Target

    pablodfd4676529.exe

  • Size

    662KB

  • MD5

    40df500e4caa9265ef6bea269c34140d

  • SHA1

    db34bb2e6dc20b945443faa9f5c5607a66638735

  • SHA256

    9e4d05b5c07d77f2bf1fd7a22c59b4932f096ad1e140a536a025b5c325683073

  • SHA512

    d51a238be322f12673fa76be731a123a2d0ca5c398a285e91a7a5bed231f4f1d5ca27e3ee0d4bd83502a064dec537a56fe9ed3f578c1e2e1595df8b7f2c7a347

  • SSDEEP

    12288:a5dPG2fJ4owKoZ4Ra6SeLDIRh+iq41d+RfgCyVN:yJ5oZ4Ra6SeXwA+d+FghV

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xchu

Decoy

zcartoons.com

castilloshowroom.com

3bmmdtod.life

misaxoxo.com

nadiya.online

sykkbup29.xyz

triciaaprimrosevp.com

newleter.com

ptzslk.xyz

lightbulbfestival.com

texaslandline.com

ideeintemporelle.com

girljustdoitpodcast.com

medimediamarketing.com

bunk7outfitters.com

charlievgrfminnick.click

lifestyleinthehome.com

atfbestsale.online

frontdoorproperties.co.uk

grandpaswag2024.info

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3140
    • C:\Users\Admin\AppData\Local\Temp\pablodfd4676529.exe
      "C:\Users\Admin\AppData\Local\Temp\pablodfd4676529.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1232
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\pablodfd4676529.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2100
      • C:\Users\Admin\AppData\Local\Temp\pablodfd4676529.exe
        "C:\Users\Admin\AppData\Local\Temp\pablodfd4676529.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:388
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\pablodfd4676529.exe"
        3⤵
          PID:2848

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b02whfbx.1qo.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/388-140-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/388-158-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/388-161-0x0000000000E90000-0x0000000000EA4000-memory.dmp
      Filesize

      80KB

    • memory/388-160-0x0000000001300000-0x000000000164A000-memory.dmp
      Filesize

      3.3MB

    • memory/1232-133-0x0000000000570000-0x000000000061C000-memory.dmp
      Filesize

      688KB

    • memory/1232-134-0x0000000005560000-0x0000000005B04000-memory.dmp
      Filesize

      5.6MB

    • memory/1232-135-0x0000000005050000-0x00000000050E2000-memory.dmp
      Filesize

      584KB

    • memory/1232-136-0x0000000004FE0000-0x0000000004FEA000-memory.dmp
      Filesize

      40KB

    • memory/1232-137-0x00000000052B0000-0x00000000052C0000-memory.dmp
      Filesize

      64KB

    • memory/1232-138-0x00000000052B0000-0x00000000052C0000-memory.dmp
      Filesize

      64KB

    • memory/1232-139-0x000000000ACD0000-0x000000000AD6C000-memory.dmp
      Filesize

      624KB

    • memory/2100-148-0x0000000006240000-0x00000000062A6000-memory.dmp
      Filesize

      408KB

    • memory/2100-164-0x0000000005410000-0x0000000005420000-memory.dmp
      Filesize

      64KB

    • memory/2100-144-0x0000000006080000-0x00000000060A2000-memory.dmp
      Filesize

      136KB

    • memory/2100-145-0x0000000006120000-0x0000000006186000-memory.dmp
      Filesize

      408KB

    • memory/2100-184-0x0000000007E90000-0x0000000007F26000-memory.dmp
      Filesize

      600KB

    • memory/2100-157-0x0000000005410000-0x0000000005420000-memory.dmp
      Filesize

      64KB

    • memory/2100-159-0x0000000005410000-0x0000000005420000-memory.dmp
      Filesize

      64KB

    • memory/2100-162-0x0000000006900000-0x000000000691E000-memory.dmp
      Filesize

      120KB

    • memory/2100-142-0x0000000005390000-0x00000000053C6000-memory.dmp
      Filesize

      216KB

    • memory/2100-143-0x0000000005A50000-0x0000000006078000-memory.dmp
      Filesize

      6.2MB

    • memory/2100-165-0x00000000078C0000-0x00000000078F2000-memory.dmp
      Filesize

      200KB

    • memory/2100-166-0x0000000070D30000-0x0000000070D7C000-memory.dmp
      Filesize

      304KB

    • memory/2100-176-0x0000000006EC0000-0x0000000006EDE000-memory.dmp
      Filesize

      120KB

    • memory/2100-188-0x0000000007F30000-0x0000000007F38000-memory.dmp
      Filesize

      32KB

    • memory/2100-187-0x0000000007F50000-0x0000000007F6A000-memory.dmp
      Filesize

      104KB

    • memory/2100-180-0x0000000008250000-0x00000000088CA000-memory.dmp
      Filesize

      6.5MB

    • memory/2100-186-0x0000000007E40000-0x0000000007E4E000-memory.dmp
      Filesize

      56KB

    • memory/2100-181-0x000000007FB70000-0x000000007FB80000-memory.dmp
      Filesize

      64KB

    • memory/2100-182-0x0000000007C10000-0x0000000007C2A000-memory.dmp
      Filesize

      104KB

    • memory/2100-183-0x0000000007C80000-0x0000000007C8A000-memory.dmp
      Filesize

      40KB

    • memory/2596-193-0x0000000002F30000-0x0000000002FC3000-memory.dmp
      Filesize

      588KB

    • memory/2596-185-0x00000000030E0000-0x000000000342A000-memory.dmp
      Filesize

      3.3MB

    • memory/2596-179-0x0000000000C60000-0x0000000000C8F000-memory.dmp
      Filesize

      188KB

    • memory/2596-178-0x0000000000D10000-0x0000000000D37000-memory.dmp
      Filesize

      156KB

    • memory/2596-177-0x0000000000D10000-0x0000000000D37000-memory.dmp
      Filesize

      156KB

    • memory/2596-191-0x0000000000C60000-0x0000000000C8F000-memory.dmp
      Filesize

      188KB

    • memory/3140-212-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-216-0x0000000001550000-0x000000000155A000-memory.dmp
      Filesize

      40KB

    • memory/3140-195-0x0000000007A30000-0x0000000007B8A000-memory.dmp
      Filesize

      1.4MB

    • memory/3140-197-0x0000000007A30000-0x0000000007B8A000-memory.dmp
      Filesize

      1.4MB

    • memory/3140-199-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-200-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-201-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-202-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-203-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-204-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-205-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-206-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-207-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-208-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-209-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-210-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-211-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-163-0x0000000009280000-0x000000000941D000-memory.dmp
      Filesize

      1.6MB

    • memory/3140-213-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-214-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-215-0x00000000013A0000-0x00000000013A2000-memory.dmp
      Filesize

      8KB

    • memory/3140-194-0x0000000007A30000-0x0000000007B8A000-memory.dmp
      Filesize

      1.4MB

    • memory/3140-219-0x0000000001550000-0x000000000155A000-memory.dmp
      Filesize

      40KB

    • memory/3140-225-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-226-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-227-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-229-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-230-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-228-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-231-0x0000000001550000-0x0000000001552000-memory.dmp
      Filesize

      8KB

    • memory/3140-232-0x0000000001550000-0x0000000001552000-memory.dmp
      Filesize

      8KB

    • memory/3140-233-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-234-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-235-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-236-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-237-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-238-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-239-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-240-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-241-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB

    • memory/3140-242-0x00000000035F0000-0x0000000003600000-memory.dmp
      Filesize

      64KB