Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 14:35

General

  • Target

    CDE 0915.exe

  • Size

    308KB

  • MD5

    8198d6bfbb6195d1658d7949a98e33ff

  • SHA1

    f0b4a41bd7dfd3e5eda456ab88de948407e3e8db

  • SHA256

    46436c9504931b7cedc6f56121141a9cca7389258def5ccb0981b9bbe2301cc5

  • SHA512

    54156e8483bcbe6a72df32a9aac438d9de82af956d6fac69c49a4cb1ab92863792dc1c0e27e44f0cd54f28136f3c72f6faca630e6a0f5734ebdbfcf17dc564d7

  • SSDEEP

    6144:LnPdudwDWtQFrtD0AaHPcmQUW6aeyVze25Sqvv+1YErCuWWQVaIaIJDbiV0bu:LnPdatQptD6HIRegeFuv+6EtWrJ/w0bu

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

k13s

Decoy

runbe.fun

factrip.com

zalenterprises.net

yoyufoods.com

soniakmahajan.com

jdfdht.site

provenimpact.net

hotelsmadridairport.com

avondalemclarenparts.com

champagnepelissot.com

dqnshtvn.click

barbarahensonrealestate.com

jrys117.top

amb168g.pro

zionsystem.live

highcaliberhusbands.com

dsc-marketing.com

outlemax.com

legalloanmaster.com

sky71.link

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Users\Admin\AppData\Local\Temp\CDE 0915.exe
      "C:\Users\Admin\AppData\Local\Temp\CDE 0915.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Users\Admin\AppData\Local\Temp\myyzql.exe
        "C:\Users\Admin\AppData\Local\Temp\myyzql.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2332
        • C:\Users\Admin\AppData\Local\Temp\myyzql.exe
          "C:\Users\Admin\AppData\Local\Temp\myyzql.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:3388
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\myyzql.exe"
        3⤵
          PID:4612

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\eazmqu.yfg

            Filesize

            205KB

            MD5

            33b827d4ebc3080d1b326e7335dfdfbe

            SHA1

            28830e77aa2c9a4b512e20d18734bf03379c81ba

            SHA256

            e18d141bb79de85f32948f75025263084559780d116f5ddbca8767636b8058d9

            SHA512

            4a47d359cded2f7c634827d2f39522bd0e4e741579401455aed57cabbefc905bf51566c5216aa7879489f7f234ee8255c5f01e7fcf079a7e6fd4cf27c848fba3

          • C:\Users\Admin\AppData\Local\Temp\myyzql.exe

            Filesize

            176KB

            MD5

            e460b7d571b50e5950fdd69feebf2357

            SHA1

            04d5a524e57a760f0bcea873faab604a6364428d

            SHA256

            c42d7a0eb68618cb608daf7de1233989e9704edbf9f8b09a590ac07c378d9fed

            SHA512

            444f6a9bb022eee54090c67534de0873f9f0e28850b49aea7163760bff72e34c61d4c840e0bde66d799c3b9f8f92e87ed1dd3f326d4be621ff6f82a3ad522863

          • C:\Users\Admin\AppData\Local\Temp\myyzql.exe

            Filesize

            176KB

            MD5

            e460b7d571b50e5950fdd69feebf2357

            SHA1

            04d5a524e57a760f0bcea873faab604a6364428d

            SHA256

            c42d7a0eb68618cb608daf7de1233989e9704edbf9f8b09a590ac07c378d9fed

            SHA512

            444f6a9bb022eee54090c67534de0873f9f0e28850b49aea7163760bff72e34c61d4c840e0bde66d799c3b9f8f92e87ed1dd3f326d4be621ff6f82a3ad522863

          • C:\Users\Admin\AppData\Local\Temp\myyzql.exe

            Filesize

            176KB

            MD5

            e460b7d571b50e5950fdd69feebf2357

            SHA1

            04d5a524e57a760f0bcea873faab604a6364428d

            SHA256

            c42d7a0eb68618cb608daf7de1233989e9704edbf9f8b09a590ac07c378d9fed

            SHA512

            444f6a9bb022eee54090c67534de0873f9f0e28850b49aea7163760bff72e34c61d4c840e0bde66d799c3b9f8f92e87ed1dd3f326d4be621ff6f82a3ad522863

          • memory/2092-21-0x0000000001170000-0x000000000119F000-memory.dmp

            Filesize

            188KB

          • memory/2092-15-0x0000000000830000-0x0000000000857000-memory.dmp

            Filesize

            156KB

          • memory/2092-16-0x0000000000830000-0x0000000000857000-memory.dmp

            Filesize

            156KB

          • memory/2092-23-0x0000000003050000-0x00000000030E3000-memory.dmp

            Filesize

            588KB

          • memory/2092-17-0x0000000001170000-0x000000000119F000-memory.dmp

            Filesize

            188KB

          • memory/2092-18-0x0000000003220000-0x000000000356A000-memory.dmp

            Filesize

            3.3MB

          • memory/2092-22-0x0000000001170000-0x000000000119F000-memory.dmp

            Filesize

            188KB

          • memory/2332-5-0x0000000001550000-0x0000000001552000-memory.dmp

            Filesize

            8KB

          • memory/2572-60-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-76-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-133-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-24-0x00000000093B0000-0x0000000009517000-memory.dmp

            Filesize

            1.4MB

          • memory/2572-25-0x00000000093B0000-0x0000000009517000-memory.dmp

            Filesize

            1.4MB

          • memory/2572-27-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-29-0x0000000001330000-0x0000000001340000-memory.dmp

            Filesize

            64KB

          • memory/2572-28-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-30-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-31-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-32-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-33-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-34-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-36-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-38-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-39-0x00000000093B0000-0x0000000009517000-memory.dmp

            Filesize

            1.4MB

          • memory/2572-40-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-41-0x0000000001440000-0x0000000001450000-memory.dmp

            Filesize

            64KB

          • memory/2572-42-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-43-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-44-0x0000000001440000-0x0000000001450000-memory.dmp

            Filesize

            64KB

          • memory/2572-46-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-45-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-47-0x0000000001330000-0x0000000001340000-memory.dmp

            Filesize

            64KB

          • memory/2572-49-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-51-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-53-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-54-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-56-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-55-0x0000000007B90000-0x0000000007BA0000-memory.dmp

            Filesize

            64KB

          • memory/2572-58-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-57-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-59-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-61-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-63-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-62-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-14-0x0000000008DB0000-0x0000000008E6A000-memory.dmp

            Filesize

            744KB

          • memory/2572-70-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-71-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-72-0x0000000001440000-0x0000000001450000-memory.dmp

            Filesize

            64KB

          • memory/2572-73-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-74-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-75-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-19-0x0000000008DB0000-0x0000000008E6A000-memory.dmp

            Filesize

            744KB

          • memory/2572-77-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-81-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-79-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-82-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-83-0x0000000003170000-0x0000000003180000-memory.dmp

            Filesize

            64KB

          • memory/2572-84-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-85-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-86-0x00000000012F0000-0x0000000001300000-memory.dmp

            Filesize

            64KB

          • memory/2572-87-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-89-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-88-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-93-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-91-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-95-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-96-0x00000000012F0000-0x0000000001300000-memory.dmp

            Filesize

            64KB

          • memory/2572-97-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-98-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-100-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-102-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-101-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-105-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-104-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-112-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-113-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-114-0x00000000032E0000-0x00000000032F0000-memory.dmp

            Filesize

            64KB

          • memory/2572-115-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-116-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-117-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-118-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-121-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-119-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-123-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-124-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-125-0x00000000032E0000-0x00000000032F0000-memory.dmp

            Filesize

            64KB

          • memory/2572-126-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-127-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-129-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-131-0x0000000001320000-0x0000000001330000-memory.dmp

            Filesize

            64KB

          • memory/2572-128-0x00000000032E0000-0x00000000032F0000-memory.dmp

            Filesize

            64KB

          • memory/3388-7-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/3388-10-0x00000000017F0000-0x0000000001B3A000-memory.dmp

            Filesize

            3.3MB

          • memory/3388-12-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/3388-13-0x00000000014C0000-0x00000000014D4000-memory.dmp

            Filesize

            80KB