Analysis

  • max time kernel
    118s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 15:11

General

  • Target

    4fb330b2b5620e1b30a795ad5d989526d7cefbcb553d4a79227b1220351d25bd.exe

  • Size

    565KB

  • MD5

    ab4f31ff0f628b02f3890e579243d004

  • SHA1

    fd527f7d882680573d4687a7a3a477f10199b083

  • SHA256

    4fb330b2b5620e1b30a795ad5d989526d7cefbcb553d4a79227b1220351d25bd

  • SHA512

    bad32cf6817e524ad44d5fced0f2102ca9d73235d7f7cda94e42c24c894f222a81bc12cf2cd734c2a55752070ea17ba07a2343bd70e9a676a6862792741532c5

  • SSDEEP

    12288:LO90wJ1tubbpOoweEyBANwQltbvBLCMTyQTxxMspirVZn7aqXEb4if018icEuA9:nwb0bbgoweEyBAGib1CMGQLMfTn7BXr7

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

4hc5

Decoy

amandaastburyillustration.com

7141999.com

showshoe.info

sagemarlin.com

lithuaniandreamtime.com

therenixgroupllc.com

avalialooks.shop

vurporn.com

lemmy.systems

2816goldfinch.com

pacersun.com

checktrace.com

loadtransfer.site

matsuri-jujutsukaisen.com

iontrapper.science

5108010.com

beidixi.com

21305599.com

peakvitality.fitness

osisfeelingfee.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4fb330b2b5620e1b30a795ad5d989526d7cefbcb553d4a79227b1220351d25bd.exe
    "C:\Users\Admin\AppData\Local\Temp\4fb330b2b5620e1b30a795ad5d989526d7cefbcb553d4a79227b1220351d25bd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\4fb330b2b5620e1b30a795ad5d989526d7cefbcb553d4a79227b1220351d25bd.exe
      "C:\Users\Admin\AppData\Local\Temp\4fb330b2b5620e1b30a795ad5d989526d7cefbcb553d4a79227b1220351d25bd.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2680

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2680-8-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2680-16-0x0000000000870000-0x0000000000B73000-memory.dmp

          Filesize

          3.0MB

        • memory/2680-14-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2680-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2680-10-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2996-3-0x0000000074440000-0x0000000074B2E000-memory.dmp

          Filesize

          6.9MB

        • memory/2996-6-0x00000000003C0000-0x00000000003CC000-memory.dmp

          Filesize

          48KB

        • memory/2996-7-0x00000000050D0000-0x000000000513E000-memory.dmp

          Filesize

          440KB

        • memory/2996-5-0x0000000000390000-0x00000000003A4000-memory.dmp

          Filesize

          80KB

        • memory/2996-4-0x0000000004B80000-0x0000000004BC0000-memory.dmp

          Filesize

          256KB

        • memory/2996-0-0x0000000074440000-0x0000000074B2E000-memory.dmp

          Filesize

          6.9MB

        • memory/2996-2-0x0000000004B80000-0x0000000004BC0000-memory.dmp

          Filesize

          256KB

        • memory/2996-15-0x0000000074440000-0x0000000074B2E000-memory.dmp

          Filesize

          6.9MB

        • memory/2996-1-0x0000000000240000-0x00000000002D4000-memory.dmp

          Filesize

          592KB