Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
24/08/2023, 05:50
General
-
Target
INVOICE.exe
-
Size
237KB
-
MD5
0ee858a143b831660ad55a2fbf13a6e1
-
SHA1
f378acacb7da3fe89f0bb0df43776797084313cf
-
SHA256
cd56edf9ac230205c76045c5fabbbf68b28b011e066721e4f2b95653dc22a34c
-
SHA512
20a4385d61c6826299b9ff3e61b101a9a57d446c967f478458369d39d6d95e3ce23a0e595f46fe68470a972869104f91c7f3f69ac9248c6dac3f05a776fa80f3
-
SSDEEP
6144:vYa618FO4xhOTAuavp5J9t/rswGImsj+O6zFhfOB6myN9d/HnpEryOd:vYP8FzMT87J9N1ZB6JgcdN9d+rFd
Malware Config
Extracted
formbook
4.1
ds19
pribit-92.com
wrist-couture.com
alanka.company
uffitgvr.click
bwtsatotravel.com
anpmarketinginc.com
startupsvibes.com
shearabia.com
sayemail5.store
solsticeinstitute.com
perfectholidaydeals.com
xfitness.life
mmbs-ad.com
jacodile.com
hjpolastudio.com
healuu.com
agtwer.homes
installationschampions.info
bettys70th.com
sustainable-re.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 4 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD569455b1cf51ca23385cd850a46eefefb
SHA154a87eaa1be72a12a276ae60aa456e088057f0fb
SHA256613dd7289f5cc9f53a850b7de98eebff647d85ecebf3e71e55c7e4cc1a4efc80
SHA5122732beafc9c1a35f38f99fa672845e741855fe18a54b9487404c7b3bafa1151b7d5dbfad28ab3158a2035bf3ff381a93bc450e9991a56b5b9ab443b93fbaca6b
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
588KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
80KB
-
Filesize
188KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
736KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB