Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 14:35

General

  • Target

    CDE 0915.exe

  • Size

    308KB

  • MD5

    8198d6bfbb6195d1658d7949a98e33ff

  • SHA1

    f0b4a41bd7dfd3e5eda456ab88de948407e3e8db

  • SHA256

    46436c9504931b7cedc6f56121141a9cca7389258def5ccb0981b9bbe2301cc5

  • SHA512

    54156e8483bcbe6a72df32a9aac438d9de82af956d6fac69c49a4cb1ab92863792dc1c0e27e44f0cd54f28136f3c72f6faca630e6a0f5734ebdbfcf17dc564d7

  • SSDEEP

    6144:LnPdudwDWtQFrtD0AaHPcmQUW6aeyVze25Sqvv+1YErCuWWQVaIaIJDbiV0bu:LnPdatQptD6HIRegeFuv+6EtWrJ/w0bu

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

k13s

Decoy

runbe.fun

factrip.com

zalenterprises.net

yoyufoods.com

soniakmahajan.com

jdfdht.site

provenimpact.net

hotelsmadridairport.com

avondalemclarenparts.com

champagnepelissot.com

dqnshtvn.click

barbarahensonrealestate.com

jrys117.top

amb168g.pro

zionsystem.live

highcaliberhusbands.com

dsc-marketing.com

outlemax.com

legalloanmaster.com

sky71.link

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\CDE 0915.exe
      "C:\Users\Admin\AppData\Local\Temp\CDE 0915.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Users\Admin\AppData\Local\Temp\myyzql.exe
        "C:\Users\Admin\AppData\Local\Temp\myyzql.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3060
        • C:\Users\Admin\AppData\Local\Temp\myyzql.exe
          "C:\Users\Admin\AppData\Local\Temp\myyzql.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2724
          • C:\Windows\SysWOW64\systray.exe
            "C:\Windows\SysWOW64\systray.exe"
            5⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2764
            • C:\Windows\SysWOW64\cmd.exe
              /c del "C:\Users\Admin\AppData\Local\Temp\myyzql.exe"
              6⤵
                PID:2624

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\eazmqu.yfg

            Filesize

            205KB

            MD5

            33b827d4ebc3080d1b326e7335dfdfbe

            SHA1

            28830e77aa2c9a4b512e20d18734bf03379c81ba

            SHA256

            e18d141bb79de85f32948f75025263084559780d116f5ddbca8767636b8058d9

            SHA512

            4a47d359cded2f7c634827d2f39522bd0e4e741579401455aed57cabbefc905bf51566c5216aa7879489f7f234ee8255c5f01e7fcf079a7e6fd4cf27c848fba3

          • C:\Users\Admin\AppData\Local\Temp\myyzql.exe

            Filesize

            176KB

            MD5

            e460b7d571b50e5950fdd69feebf2357

            SHA1

            04d5a524e57a760f0bcea873faab604a6364428d

            SHA256

            c42d7a0eb68618cb608daf7de1233989e9704edbf9f8b09a590ac07c378d9fed

            SHA512

            444f6a9bb022eee54090c67534de0873f9f0e28850b49aea7163760bff72e34c61d4c840e0bde66d799c3b9f8f92e87ed1dd3f326d4be621ff6f82a3ad522863

          • C:\Users\Admin\AppData\Local\Temp\myyzql.exe

            Filesize

            176KB

            MD5

            e460b7d571b50e5950fdd69feebf2357

            SHA1

            04d5a524e57a760f0bcea873faab604a6364428d

            SHA256

            c42d7a0eb68618cb608daf7de1233989e9704edbf9f8b09a590ac07c378d9fed

            SHA512

            444f6a9bb022eee54090c67534de0873f9f0e28850b49aea7163760bff72e34c61d4c840e0bde66d799c3b9f8f92e87ed1dd3f326d4be621ff6f82a3ad522863

          • C:\Users\Admin\AppData\Local\Temp\myyzql.exe

            Filesize

            176KB

            MD5

            e460b7d571b50e5950fdd69feebf2357

            SHA1

            04d5a524e57a760f0bcea873faab604a6364428d

            SHA256

            c42d7a0eb68618cb608daf7de1233989e9704edbf9f8b09a590ac07c378d9fed

            SHA512

            444f6a9bb022eee54090c67534de0873f9f0e28850b49aea7163760bff72e34c61d4c840e0bde66d799c3b9f8f92e87ed1dd3f326d4be621ff6f82a3ad522863

          • \Users\Admin\AppData\Local\Temp\myyzql.exe

            Filesize

            176KB

            MD5

            e460b7d571b50e5950fdd69feebf2357

            SHA1

            04d5a524e57a760f0bcea873faab604a6364428d

            SHA256

            c42d7a0eb68618cb608daf7de1233989e9704edbf9f8b09a590ac07c378d9fed

            SHA512

            444f6a9bb022eee54090c67534de0873f9f0e28850b49aea7163760bff72e34c61d4c840e0bde66d799c3b9f8f92e87ed1dd3f326d4be621ff6f82a3ad522863

          • \Users\Admin\AppData\Local\Temp\myyzql.exe

            Filesize

            176KB

            MD5

            e460b7d571b50e5950fdd69feebf2357

            SHA1

            04d5a524e57a760f0bcea873faab604a6364428d

            SHA256

            c42d7a0eb68618cb608daf7de1233989e9704edbf9f8b09a590ac07c378d9fed

            SHA512

            444f6a9bb022eee54090c67534de0873f9f0e28850b49aea7163760bff72e34c61d4c840e0bde66d799c3b9f8f92e87ed1dd3f326d4be621ff6f82a3ad522863

          • memory/1244-28-0x0000000006D50000-0x0000000006EE3000-memory.dmp

            Filesize

            1.6MB

          • memory/1244-23-0x0000000006D50000-0x0000000006EE3000-memory.dmp

            Filesize

            1.6MB

          • memory/1244-32-0x0000000003AD0000-0x0000000003BA8000-memory.dmp

            Filesize

            864KB

          • memory/1244-34-0x0000000003AD0000-0x0000000003BA8000-memory.dmp

            Filesize

            864KB

          • memory/1244-16-0x00000000037E0000-0x00000000038E0000-memory.dmp

            Filesize

            1024KB

          • memory/1244-36-0x0000000003AD0000-0x0000000003BA8000-memory.dmp

            Filesize

            864KB

          • memory/1244-18-0x0000000006AE0000-0x0000000006C5E000-memory.dmp

            Filesize

            1.5MB

          • memory/1244-31-0x00000000037E0000-0x00000000038E0000-memory.dmp

            Filesize

            1024KB

          • memory/1244-22-0x00000000037E0000-0x00000000038E0000-memory.dmp

            Filesize

            1024KB

          • memory/2724-21-0x0000000000350000-0x0000000000364000-memory.dmp

            Filesize

            80KB

          • memory/2724-20-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2724-10-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2724-17-0x0000000000200000-0x0000000000214000-memory.dmp

            Filesize

            80KB

          • memory/2724-15-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2724-13-0x0000000000800000-0x0000000000B03000-memory.dmp

            Filesize

            3.0MB

          • memory/2764-24-0x00000000007E0000-0x00000000007E5000-memory.dmp

            Filesize

            20KB

          • memory/2764-29-0x0000000000080000-0x00000000000AF000-memory.dmp

            Filesize

            188KB

          • memory/2764-30-0x0000000001CF0000-0x0000000001D83000-memory.dmp

            Filesize

            588KB

          • memory/2764-27-0x0000000001EC0000-0x00000000021C3000-memory.dmp

            Filesize

            3.0MB

          • memory/2764-26-0x0000000000080000-0x00000000000AF000-memory.dmp

            Filesize

            188KB

          • memory/2764-25-0x00000000007E0000-0x00000000007E5000-memory.dmp

            Filesize

            20KB

          • memory/3060-6-0x0000000000090000-0x0000000000092000-memory.dmp

            Filesize

            8KB