Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 15:28

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.21070.exe

  • Size

    852KB

  • MD5

    9db2aef89a0872e99d266cfb6ed00999

  • SHA1

    4ff386a6dc8f254c76215243d28ca3efbd934c1b

  • SHA256

    ce345574366b94994a2aade4a96ade0eee23ad088211416b5695166cd251ec61

  • SHA512

    07b568f24429c68ec06b87457ff969f7b70e12720d656d91e0680f3251ec6600f7ac559b8e858ebd71c09e067dd09c009bb791e7a3333ed9e95babf70f970c48

  • SSDEEP

    12288:vP27U0WWObWpf57f6ESknqQrQJfI2CiPQfP12Xk/Nl1dSQ1Ulx3/z6OAq7hxfZuk:veD4+f5eEn1mxCiPQfP28NX0Qulxw

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

v93r

Decoy

labourcommunitymarket.com

nba82.com

datahabitsales.site

rosstony.link

baliorganic.farm

qefhyjngrxcbjfvgft.autos

bippttcg.click

tldrschool.com

vcdaawug.click

garage2mats.com

soulrin.store

themezodermacream.com

522fairwaylookout.com

jmhoa.cyou

sygcb.link

thanhpresident.com

biy-home.com

imtmlife.online

dijitalpasaj.app

105261.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21070.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21070.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21070.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21070.exe"
      2⤵
        PID:2820
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21070.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21070.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2108
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21070.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21070.exe"
        2⤵
          PID:3328
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21070.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21070.exe"
          2⤵
            PID:3312

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2108-12-0x0000000000400000-0x000000000042F000-memory.dmp

                Filesize

                188KB

              • memory/2108-15-0x0000000001520000-0x000000000186A000-memory.dmp

                Filesize

                3.3MB

              • memory/4328-6-0x0000000007EE0000-0x0000000007EF4000-memory.dmp

                Filesize

                80KB

              • memory/4328-3-0x0000000007D30000-0x0000000007DC2000-memory.dmp

                Filesize

                584KB

              • memory/4328-4-0x0000000007F60000-0x0000000007F70000-memory.dmp

                Filesize

                64KB

              • memory/4328-5-0x0000000007ED0000-0x0000000007EDA000-memory.dmp

                Filesize

                40KB

              • memory/4328-0-0x0000000000D90000-0x0000000000E6A000-memory.dmp

                Filesize

                872KB

              • memory/4328-7-0x00000000746D0000-0x0000000074E80000-memory.dmp

                Filesize

                7.7MB

              • memory/4328-8-0x0000000007F60000-0x0000000007F70000-memory.dmp

                Filesize

                64KB

              • memory/4328-9-0x0000000007F40000-0x0000000007F4C000-memory.dmp

                Filesize

                48KB

              • memory/4328-10-0x00000000088B0000-0x000000000891E000-memory.dmp

                Filesize

                440KB

              • memory/4328-11-0x000000000C130000-0x000000000C1CC000-memory.dmp

                Filesize

                624KB

              • memory/4328-2-0x0000000008200000-0x00000000087A4000-memory.dmp

                Filesize

                5.6MB

              • memory/4328-14-0x00000000746D0000-0x0000000074E80000-memory.dmp

                Filesize

                7.7MB

              • memory/4328-1-0x00000000746D0000-0x0000000074E80000-memory.dmp

                Filesize

                7.7MB