Analysis

  • max time kernel
    153s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 07:56

General

  • Target

    Delivery Advice_pdf.exe

  • Size

    599KB

  • MD5

    6074ee36c8396cb9eb740fd7b17717b4

  • SHA1

    54863bae13ae43c648e591bffd462fd21a8ae997

  • SHA256

    63f0ca19b1c85d5ff157194089a45b59a76f7405e89eba21741afa81c00575b7

  • SHA512

    4108db1c0725f808955705d8cb2edef004556c6cd4024eeb632ece4c05e60203b211f56da0276b161dc0ddd4f079c2f91b16c3abdcfad78f1aafdbf654716737

  • SSDEEP

    12288:6dJP+NXCvoqzLEJkb/jcak1Jp18n/MZyxQQvUipjeX+jvv7:6dJPuCvoqLckzjcak778n/MZyGQsmeXq

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ls02

Decoy

vocabularybot.com

invisalignsmilesolutions.xyz

sleepdisorderinsomnia.com

bern.beauty

ahazmcdris.top

21874960sie8ca1.store

yeitced.xyz

biggerpictureventures.com

alduhagroup.com

itsolutions.biz

0oq6y.com

wildpolis.com

mariobet469.com

brynnwpods.com

tastywin.com

cou2m1.com

newaitrucks.com

puremeans.studio

mitienda-la.com

jujuresorthotel.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Users\Admin\AppData\Local\Temp\Delivery Advice_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Delivery Advice_pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Users\Admin\AppData\Local\Temp\Delivery Advice_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\Delivery Advice_pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4996
    • C:\Windows\SysWOW64\WWAHost.exe
      "C:\Windows\SysWOW64\WWAHost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Delivery Advice_pdf.exe"
        3⤵
          PID:2052

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3148-34-0x00000000029F0000-0x0000000002A9D000-memory.dmp

            Filesize

            692KB

          • memory/3148-19-0x00000000089F0000-0x0000000008B89000-memory.dmp

            Filesize

            1.6MB

          • memory/3148-31-0x00000000029F0000-0x0000000002A9D000-memory.dmp

            Filesize

            692KB

          • memory/3148-32-0x00000000029F0000-0x0000000002A9D000-memory.dmp

            Filesize

            692KB

          • memory/3148-22-0x00000000089F0000-0x0000000008B89000-memory.dmp

            Filesize

            1.6MB

          • memory/3376-4-0x0000000005990000-0x00000000059A0000-memory.dmp

            Filesize

            64KB

          • memory/3376-6-0x0000000005CE0000-0x0000000005CF6000-memory.dmp

            Filesize

            88KB

          • memory/3376-7-0x0000000074810000-0x0000000074FC0000-memory.dmp

            Filesize

            7.7MB

          • memory/3376-8-0x0000000005990000-0x00000000059A0000-memory.dmp

            Filesize

            64KB

          • memory/3376-9-0x0000000006D00000-0x0000000006D10000-memory.dmp

            Filesize

            64KB

          • memory/3376-10-0x0000000007300000-0x000000000736E000-memory.dmp

            Filesize

            440KB

          • memory/3376-11-0x0000000008690000-0x000000000872C000-memory.dmp

            Filesize

            624KB

          • memory/3376-5-0x00000000057C0000-0x00000000057CA000-memory.dmp

            Filesize

            40KB

          • memory/3376-14-0x0000000074810000-0x0000000074FC0000-memory.dmp

            Filesize

            7.7MB

          • memory/3376-3-0x00000000057E0000-0x0000000005872000-memory.dmp

            Filesize

            584KB

          • memory/3376-2-0x0000000005CF0000-0x0000000006294000-memory.dmp

            Filesize

            5.6MB

          • memory/3376-0-0x0000000000D60000-0x0000000000DFA000-memory.dmp

            Filesize

            616KB

          • memory/3376-1-0x0000000074810000-0x0000000074FC0000-memory.dmp

            Filesize

            7.7MB

          • memory/4632-25-0x0000000000F80000-0x0000000000FAF000-memory.dmp

            Filesize

            188KB

          • memory/4632-20-0x0000000000830000-0x000000000090C000-memory.dmp

            Filesize

            880KB

          • memory/4632-23-0x0000000000830000-0x000000000090C000-memory.dmp

            Filesize

            880KB

          • memory/4632-26-0x00000000020F0000-0x000000000243A000-memory.dmp

            Filesize

            3.3MB

          • memory/4632-28-0x0000000000F80000-0x0000000000FAF000-memory.dmp

            Filesize

            188KB

          • memory/4632-30-0x0000000001FD0000-0x0000000002063000-memory.dmp

            Filesize

            588KB

          • memory/4996-18-0x00000000014F0000-0x0000000001504000-memory.dmp

            Filesize

            80KB

          • memory/4996-17-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/4996-15-0x0000000001550000-0x000000000189A000-memory.dmp

            Filesize

            3.3MB

          • memory/4996-12-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB