Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 09:31

General

  • Target

    tmpp0z2ll9l.exe

  • Size

    592KB

  • MD5

    00b27694025e82652c1976c6745a2de1

  • SHA1

    4540fad255e77cb3e58c8df7d2d9b8c746e41248

  • SHA256

    15426243aa8d60c8592a759e72f42ee2b1d9f2cbf96018c565ce70fd6778ca33

  • SHA512

    561ed6bdbbbdee54e9a9c5a70e370c425084f129b493c92f566921d1a17856ba3e96c8bdc27d863be09efa8fd93dd82b047ef212da5619335c6b344152796cda

  • SSDEEP

    12288:fO7s9Cxh5ukOsWyb/FdmwEf8aAaTbg6XFoC5GjtXy+y+6TnGpODSBnuq:W7s9yZ9WyTEb5vNXirjhT6TGpOQn

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

btrd

Decoy

toulouse.gold

launchyouglobal.com

margarita-services.com

dasnail.club

casa-hilo.com

hardscapesofflorida.com

thepositivitypulse.com

kkmyanev.cfd

love6ace22.top

castorcruise.com

chch6.com

h59f07jy.cfd

saatvikteerthyatra.com

fxsecuretrading-option.com

mostbet-k1o.click

36-m.beauty

ko-or-a-news.com

eurekatextile.com

gynlkj.com

deepsouthcraftsman.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\tmpp0z2ll9l.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpp0z2ll9l.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Users\Admin\AppData\Local\Temp\tmpp0z2ll9l.exe
        "C:\Users\Admin\AppData\Local\Temp\tmpp0z2ll9l.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:744
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1348
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\tmpp0z2ll9l.exe"
        3⤵
          PID:1096

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/744-12-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/744-18-0x0000000001490000-0x00000000014A4000-memory.dmp

            Filesize

            80KB

          • memory/744-17-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/744-15-0x0000000001A10000-0x0000000001D5A000-memory.dmp

            Filesize

            3.3MB

          • memory/1084-31-0x0000000008CC0000-0x0000000008E33000-memory.dmp

            Filesize

            1.4MB

          • memory/1084-29-0x0000000008CC0000-0x0000000008E33000-memory.dmp

            Filesize

            1.4MB

          • memory/1084-28-0x0000000008CC0000-0x0000000008E33000-memory.dmp

            Filesize

            1.4MB

          • memory/1084-25-0x0000000003060000-0x00000000031AD000-memory.dmp

            Filesize

            1.3MB

          • memory/1084-19-0x0000000003060000-0x00000000031AD000-memory.dmp

            Filesize

            1.3MB

          • memory/1348-23-0x0000000002B40000-0x0000000002E8A000-memory.dmp

            Filesize

            3.3MB

          • memory/1348-24-0x00000000006C0000-0x00000000006EF000-memory.dmp

            Filesize

            188KB

          • memory/1348-27-0x0000000002910000-0x00000000029A3000-memory.dmp

            Filesize

            588KB

          • memory/1348-22-0x00000000006C0000-0x00000000006EF000-memory.dmp

            Filesize

            188KB

          • memory/1348-21-0x0000000000740000-0x0000000000767000-memory.dmp

            Filesize

            156KB

          • memory/1348-20-0x0000000000740000-0x0000000000767000-memory.dmp

            Filesize

            156KB

          • memory/2516-1-0x0000000074E30000-0x00000000755E0000-memory.dmp

            Filesize

            7.7MB

          • memory/2516-6-0x0000000006620000-0x0000000006638000-memory.dmp

            Filesize

            96KB

          • memory/2516-5-0x0000000005000000-0x000000000500A000-memory.dmp

            Filesize

            40KB

          • memory/2516-8-0x0000000004F80000-0x0000000004F90000-memory.dmp

            Filesize

            64KB

          • memory/2516-14-0x0000000074E30000-0x00000000755E0000-memory.dmp

            Filesize

            7.7MB

          • memory/2516-9-0x00000000063C0000-0x00000000063D0000-memory.dmp

            Filesize

            64KB

          • memory/2516-7-0x0000000074E30000-0x00000000755E0000-memory.dmp

            Filesize

            7.7MB

          • memory/2516-10-0x0000000006810000-0x000000000687E000-memory.dmp

            Filesize

            440KB

          • memory/2516-4-0x0000000004F80000-0x0000000004F90000-memory.dmp

            Filesize

            64KB

          • memory/2516-11-0x0000000007B90000-0x0000000007C2C000-memory.dmp

            Filesize

            624KB

          • memory/2516-3-0x0000000005080000-0x0000000005112000-memory.dmp

            Filesize

            584KB

          • memory/2516-2-0x0000000005590000-0x0000000005B34000-memory.dmp

            Filesize

            5.6MB

          • memory/2516-0-0x00000000006D0000-0x000000000076A000-memory.dmp

            Filesize

            616KB