Analysis

  • max time kernel
    152s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    29-06-2023 14:45

General

  • Target

    pablozx.exe

  • Size

    662KB

  • MD5

    40df500e4caa9265ef6bea269c34140d

  • SHA1

    db34bb2e6dc20b945443faa9f5c5607a66638735

  • SHA256

    9e4d05b5c07d77f2bf1fd7a22c59b4932f096ad1e140a536a025b5c325683073

  • SHA512

    d51a238be322f12673fa76be731a123a2d0ca5c398a285e91a7a5bed231f4f1d5ca27e3ee0d4bd83502a064dec537a56fe9ed3f578c1e2e1595df8b7f2c7a347

  • SSDEEP

    12288:a5dPG2fJ4owKoZ4Ra6SeLDIRh+iq41d+RfgCyVN:yJ5oZ4Ra6SeXwA+d+FghV

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xchu

Decoy

zcartoons.com

castilloshowroom.com

3bmmdtod.life

misaxoxo.com

nadiya.online

sykkbup29.xyz

triciaaprimrosevp.com

newleter.com

ptzslk.xyz

lightbulbfestival.com

texaslandline.com

ideeintemporelle.com

girljustdoitpodcast.com

medimediamarketing.com

bunk7outfitters.com

charlievgrfminnick.click

lifestyleinthehome.com

atfbestsale.online

frontdoorproperties.co.uk

grandpaswag2024.info

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\pablozx.exe
      "C:\Users\Admin\AppData\Local\Temp\pablozx.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\pablozx.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:656
      • C:\Users\Admin\AppData\Local\Temp\pablozx.exe
        "C:\Users\Admin\AppData\Local\Temp\pablozx.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:756
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:1676
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:1540
        • C:\Windows\SysWOW64\NETSTAT.EXE
          "C:\Windows\SysWOW64\NETSTAT.EXE"
          2⤵
          • Suspicious use of SetThreadContext
          • Gathers network information
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\pablozx.exe"
            3⤵
            • Deletes itself
            PID:1308

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Command-Line Interface

      1
      T1059

      Discovery

      System Information Discovery

      2
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/656-72-0x00000000025B0000-0x00000000025F0000-memory.dmp
        Filesize

        256KB

      • memory/756-70-0x0000000000140000-0x0000000000154000-memory.dmp
        Filesize

        80KB

      • memory/756-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
        Filesize

        4KB

      • memory/756-69-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/756-68-0x00000000008D0000-0x0000000000BD3000-memory.dmp
        Filesize

        3.0MB

      • memory/756-63-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/756-61-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/756-60-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/1208-81-0x0000000006090000-0x0000000006147000-memory.dmp
        Filesize

        732KB

      • memory/1208-71-0x00000000047B0000-0x00000000048E0000-memory.dmp
        Filesize

        1.2MB

      • memory/1208-65-0x0000000002D80000-0x0000000002E80000-memory.dmp
        Filesize

        1024KB

      • memory/1208-84-0x0000000006090000-0x0000000006147000-memory.dmp
        Filesize

        732KB

      • memory/1208-82-0x0000000006090000-0x0000000006147000-memory.dmp
        Filesize

        732KB

      • memory/1896-80-0x0000000000B50000-0x0000000000BE3000-memory.dmp
        Filesize

        588KB

      • memory/1896-73-0x0000000000E60000-0x0000000000E69000-memory.dmp
        Filesize

        36KB

      • memory/1896-74-0x0000000000E60000-0x0000000000E69000-memory.dmp
        Filesize

        36KB

      • memory/1896-75-0x00000000000E0000-0x000000000010F000-memory.dmp
        Filesize

        188KB

      • memory/1896-76-0x0000000002400000-0x0000000002703000-memory.dmp
        Filesize

        3.0MB

      • memory/1896-77-0x00000000000E0000-0x000000000010F000-memory.dmp
        Filesize

        188KB

      • memory/2024-55-0x0000000004E40000-0x0000000004E80000-memory.dmp
        Filesize

        256KB

      • memory/2024-58-0x0000000000990000-0x000000000099C000-memory.dmp
        Filesize

        48KB

      • memory/2024-59-0x0000000005C10000-0x0000000005C7E000-memory.dmp
        Filesize

        440KB

      • memory/2024-54-0x0000000000C10000-0x0000000000CBC000-memory.dmp
        Filesize

        688KB

      • memory/2024-56-0x0000000000670000-0x000000000067C000-memory.dmp
        Filesize

        48KB

      • memory/2024-57-0x0000000004E40000-0x0000000004E80000-memory.dmp
        Filesize

        256KB