Analysis

  • max time kernel
    44s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    13-08-2023 18:33

General

  • Target

    bin.exe

  • Size

    167KB

  • MD5

    efb72c1ec0608a79de8bd3ee79c0bad2

  • SHA1

    b7ca0fde5e0b4e86d5f7f66defd9c20fbbd2ba23

  • SHA256

    a78a59d1d3598c29e0bfba14bb0ca09a2263f7e60af88cd09a85ee39272bcf79

  • SHA512

    31e720486a325d89e7f80193b9ed37298c50a9cc1dc34d112c8c6ec6e421590fac4284daa98c49f91ac5b3b6b3bec230d58e1f58f0fa9f47ba150f724365198b

  • SSDEEP

    3072:16VXCc3/7KNo2ymzGLo3Kh4zVVBYDPhSkrKjQSKT55oGUFCy:Mj/03zG86KzVVBYDJSAK0T4GUb

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

da

Decoy

chainwalkchambers.com

foxyhaul.com

yetisnackdesigns.com

paleodiettips.xyz

51zxsf.com

jisulianxiufu.com

qianbianyun.com

unitedresponders.info

contentlab.video

traveloyunnan.com

tonybehrenslaw.com

adithyafuels.com

huanayule.net

conscious-cross.com

link2register.com

anchoritis.com

vicente20.com

jnmbc.info

m-1944.com

naap-tol.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Users\Admin\AppData\Local\Temp\bin.exe
      "C:\Users\Admin\AppData\Local\Temp\bin.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:2080
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:556
      • C:\Windows\SysWOW64\cmstp.exe
        "C:\Windows\SysWOW64\cmstp.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1872
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\bin.exe"
          3⤵
          • Deletes itself
          PID:2940

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1272-63-0x00000000045A0000-0x000000000466F000-memory.dmp
      Filesize

      828KB

    • memory/1272-56-0x0000000000010000-0x0000000000020000-memory.dmp
      Filesize

      64KB

    • memory/1272-70-0x0000000006AD0000-0x0000000006BFE000-memory.dmp
      Filesize

      1.2MB

    • memory/1272-68-0x0000000006AD0000-0x0000000006BFE000-memory.dmp
      Filesize

      1.2MB

    • memory/1272-58-0x00000000045A0000-0x000000000466F000-memory.dmp
      Filesize

      828KB

    • memory/1272-67-0x0000000006AD0000-0x0000000006BFE000-memory.dmp
      Filesize

      1.2MB

    • memory/1872-60-0x0000000000FE0000-0x0000000000FF8000-memory.dmp
      Filesize

      96KB

    • memory/1872-61-0x00000000000D0000-0x00000000000FA000-memory.dmp
      Filesize

      168KB

    • memory/1872-62-0x0000000000B90000-0x0000000000E93000-memory.dmp
      Filesize

      3.0MB

    • memory/1872-65-0x0000000000960000-0x00000000009F3000-memory.dmp
      Filesize

      588KB

    • memory/1872-66-0x00000000000D0000-0x00000000000FA000-memory.dmp
      Filesize

      168KB

    • memory/1872-59-0x0000000000FE0000-0x0000000000FF8000-memory.dmp
      Filesize

      96KB

    • memory/2080-54-0x0000000000A70000-0x0000000000D73000-memory.dmp
      Filesize

      3.0MB

    • memory/2080-57-0x0000000000190000-0x00000000001A4000-memory.dmp
      Filesize

      80KB

    • memory/2080-55-0x0000000000E00000-0x0000000000E2A000-memory.dmp
      Filesize

      168KB