Analysis
-
max time kernel
161s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
19-09-2023 10:53
General
-
Target
847c4cd760ad16321f9ec78b672e81da.exe
-
Size
330KB
-
MD5
847c4cd760ad16321f9ec78b672e81da
-
SHA1
b0e07be4c8c4eb5996cf640a170485ef5268b027
-
SHA256
8b57c28d168dbb2d1f1a7520c4331c657ba9970be6eba72a552b58ad3519e0e8
-
SHA512
835bf6c1e490756fc6802271d2bab047b0b322b65b7fd5a5260acb728fc54771f9298fde205304ea13ecadcf561c15d1af116085d8d80160bb323b9653384644
-
SSDEEP
6144:vYa63g64a5n8qTnqjbZVTPeB2iAdZS+CiBttk7HtH/oLx4iBUhez:vY5g64a5ntnqHX22KiB0fG4mP
Malware Config
Extracted
formbook
4.1
sy22
vinteligencia.com
displayfridges.fun
completetip.com
giallozafferrano.com
jizihao1.com
mysticheightstrail.com
fourseasonslb.com
kjnala.shop
mosiacwall.com
vandistreet.com
gracefullytouchedartistry.com
hbiwhwr.shop
mfmz.net
hrmbrillianz.com
funwarsztat.com
polewithcandy.com
ourrajasthan.com
wilhouettteamerica.com
johnnystintshop.com
asgnelwin.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 4 IoCs
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\847c4cd760ad16321f9ec78b672e81da.exe"C:\Users\Admin\AppData\Local\Temp\847c4cd760ad16321f9ec78b672e81da.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jkaeg.exe"C:\Users\Admin\AppData\Local\Temp\jkaeg.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jkaeg.exe"C:\Users\Admin\AppData\Local\Temp\jkaeg.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\jkaeg.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD506ddb8dafba1b7be97e46a02c1d53dd5
SHA153b6374d3785a69eb168d580b5a0cbf1d89464c7
SHA256725ca897476b8c158b5401da8a1bbb9cb65919dfe288b156189e8917cb9845c5
SHA512f78ade82990fd7d856fe65a319d7658ec8f128065428328a0ca61ec12a4305ddf96093dbf0d33edb7aced47db98febf808288f7a67e1b26430dcbacc304880de
-
Filesize
200KB
MD506ddb8dafba1b7be97e46a02c1d53dd5
SHA153b6374d3785a69eb168d580b5a0cbf1d89464c7
SHA256725ca897476b8c158b5401da8a1bbb9cb65919dfe288b156189e8917cb9845c5
SHA512f78ade82990fd7d856fe65a319d7658ec8f128065428328a0ca61ec12a4305ddf96093dbf0d33edb7aced47db98febf808288f7a67e1b26430dcbacc304880de
-
Filesize
200KB
MD506ddb8dafba1b7be97e46a02c1d53dd5
SHA153b6374d3785a69eb168d580b5a0cbf1d89464c7
SHA256725ca897476b8c158b5401da8a1bbb9cb65919dfe288b156189e8917cb9845c5
SHA512f78ade82990fd7d856fe65a319d7658ec8f128065428328a0ca61ec12a4305ddf96093dbf0d33edb7aced47db98febf808288f7a67e1b26430dcbacc304880de
-
Filesize
205KB
MD5aa42059717645951bdeba3fa472e5240
SHA1c838b76f3b424ebac57d0616067bbfc44ff6c23b
SHA2564b155e27b98898a933495c48697d0f800e9c7e4be888a3e6f4bd42efd652f917
SHA512621fe855fd6327249b65bedf1627b23e459d47c3bc5881c89717ac1015dcb064bf3f218110efd0d94dd4d0d584b52e407722c79192c5cddca7bb6ac6c4a95b75
-
Filesize
188KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
588KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
80KB
-
Filesize
8KB