Analysis

  • max time kernel
    150s
  • max time network
    167s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 14:50

General

  • Target

    Invoice#23615B001.exe

  • Size

    642KB

  • MD5

    2673a176c9729737316a6e6d660f0f79

  • SHA1

    f3466f9e8e6d1c9e9d22e6fe9e2ee601d9c22788

  • SHA256

    02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec

  • SHA512

    9e6d7703c8993e27b86bc5d4549e224db18176034e6d4331ab483dc187c77c543084cef2468a368a1dd48b0d678dc8f509ababb185b97d7756c426948442e958

  • SSDEEP

    12288:KayccWwjCUqEupAtlUpQSkHBkiyrhKwAKNdI0U+VRslA7jbA:0CdEupkl4RmkvyeI0TR17j

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sn26

Decoy

resenha10.bet

gulshan-rajput.com

xbus.tech

z813my.cfd

wlxzjlny.cfd

auntengotiempo.com

canada-reservation.com

thegiftcompany.shop

esthersilveirapropiedades.com

1wapws.top

ymjblnvo.cfd

termokimik.net

kushiro-artist-school.com

bmmboo.com

caceresconstructionservices.com

kentuckywalkabout.com

bringyourcart.com

miamiwinetour.com

bobcatsocial.site

thirdmind.network

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 5 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\Invoice#23615B001.exe
      "C:\Users\Admin\AppData\Local\Temp\Invoice#23615B001.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Users\Admin\AppData\Local\Temp\Invoice#23615B001.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\SysWOW64\cmd.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2536
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\Invoice#23615B001.exe"
            5⤵
            • Deletes itself
            PID:2668

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1208-18-0x0000000008C00000-0x0000000008DAC000-memory.dmp

          Filesize

          1.7MB

        • memory/1208-34-0x0000000009780000-0x00000000098FB000-memory.dmp

          Filesize

          1.5MB

        • memory/1208-33-0x0000000009780000-0x00000000098FB000-memory.dmp

          Filesize

          1.5MB

        • memory/1208-31-0x0000000009780000-0x00000000098FB000-memory.dmp

          Filesize

          1.5MB

        • memory/1208-24-0x000007FF65EC0000-0x000007FF65ECA000-memory.dmp

          Filesize

          40KB

        • memory/1208-23-0x000007FEF5350000-0x000007FEF5493000-memory.dmp

          Filesize

          1.3MB

        • memory/1208-22-0x0000000006090000-0x00000000061D4000-memory.dmp

          Filesize

          1.3MB

        • memory/2260-7-0x0000000004350000-0x0000000004398000-memory.dmp

          Filesize

          288KB

        • memory/2260-0-0x0000000073F20000-0x000000007460E000-memory.dmp

          Filesize

          6.9MB

        • memory/2260-1-0x0000000000BE0000-0x0000000000C86000-memory.dmp

          Filesize

          664KB

        • memory/2260-2-0x00000000020C0000-0x0000000002100000-memory.dmp

          Filesize

          256KB

        • memory/2260-3-0x0000000000390000-0x000000000039C000-memory.dmp

          Filesize

          48KB

        • memory/2260-13-0x0000000073F20000-0x000000007460E000-memory.dmp

          Filesize

          6.9MB

        • memory/2260-4-0x0000000073F20000-0x000000007460E000-memory.dmp

          Filesize

          6.9MB

        • memory/2260-5-0x00000000020C0000-0x0000000002100000-memory.dmp

          Filesize

          256KB

        • memory/2260-6-0x0000000005DC0000-0x0000000005E5A000-memory.dmp

          Filesize

          616KB

        • memory/2536-29-0x00000000000C0000-0x00000000000EF000-memory.dmp

          Filesize

          188KB

        • memory/2536-27-0x00000000000C0000-0x00000000000EF000-memory.dmp

          Filesize

          188KB

        • memory/2536-26-0x0000000049F00000-0x0000000049F4C000-memory.dmp

          Filesize

          304KB

        • memory/2536-28-0x0000000001F80000-0x0000000002283000-memory.dmp

          Filesize

          3.0MB

        • memory/2536-25-0x0000000049F00000-0x0000000049F4C000-memory.dmp

          Filesize

          304KB

        • memory/2536-30-0x0000000001DF0000-0x0000000001E84000-memory.dmp

          Filesize

          592KB

        • memory/2752-14-0x0000000000870000-0x0000000000B73000-memory.dmp

          Filesize

          3.0MB

        • memory/2752-21-0x0000000000360000-0x0000000000375000-memory.dmp

          Filesize

          84KB

        • memory/2752-20-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2752-17-0x0000000000300000-0x0000000000315000-memory.dmp

          Filesize

          84KB

        • memory/2752-16-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2752-8-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2752-12-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2752-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2752-9-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB