Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
16-08-2023 12:27
General
-
Target
invoice.exe
-
Size
926KB
-
MD5
f93b86ab785cc1422188c476d3483ad5
-
SHA1
cb8e9cedad42afbf0a32cdc58643450fd149e6ad
-
SHA256
6217071ee755bb3de9914c5ee71161ed5666acd77c7cb6bd972d465707bf0613
-
SHA512
b7161e145dcf2ab24816866980f8afb42f0535e75a66c870c86f043140580203d94bd754ee35a52f2dc6722d282fdf48aa6f87b85ec7d97c8a6b80efc3258c63
-
SSDEEP
12288:D1PDogOtA1MUII0a6PCKv3rBtOpxP2eZrW2uvMrxJ8mJAsjFmR00lqTjgidAA:STUIIN6PCKCpxDrFyOxJ8aAwAgTjjA
Malware Config
Extracted
formbook
4.1
e14e
bekamwanitajogja.com
dysae21.xyz
warehouse-top-jobs.today
h53h.com
fertility.builders
coincallpro.com
gdlinternational.sale
r3hews.shop
sg199.com
whitehillmemorials.com
nadadedor.com
pamphletbox.com
4dsmartglass.com
avaluxuryliving.com
fatdog.club
insightinvention.com
exmigraine.com
bridxo.xyz
wy6zbsa.xyz
jithinvijay.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 5 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice.exe"C:\Users\Admin\AppData\Local\Temp\invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice.exe"C:\Users\Admin\AppData\Local\Temp\invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\invoice.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
-
Filesize
80KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
724KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
724KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
5.6MB
-
Filesize
952KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
48KB
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
48KB
-
Filesize
188KB
-
Filesize
588KB
-
Filesize
188KB