Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 12:32

General

  • Target

    Orden de compra #8730.exe

  • Size

    585KB

  • MD5

    f4160af2dc8460d93fd6e214342ffb5c

  • SHA1

    aa38b128bc1effa340cc84895fd5e045d110f1c8

  • SHA256

    4925cdeb3b005a19922432760e7fbc8ae29fe02668559b1fc22d57f571424d5a

  • SHA512

    10d67a9434528aaf22704a05ff03c39b99e88ebf09d02f0b6b5b366f6084efdca00848ffb3dc7e0fcebeb588b394ef58da45033125a3b2cf1336fd2e13ab11e2

  • SSDEEP

    12288:wvochCdHXBet48VRebVrnu5pVjumj9BYWun:wvochqXaxRebVru5Pj9

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g11y

Decoy

bayivip.top

lunarrhythmsliving.com

elizabethanbello.art

plushkitchen.com

timedb.net

exploringaging.com

dreamoney.online

luvisusllc.com

strikemedialabs.com

belvederesportsclub.com

turteen.com

theofficialtrumpcards.com

x-y-z.online

otuvu.com

outhandsbpm.com

scabiosa.top

99job.store

afcxz80whz.com

mysrz3l47.top

sarekaonsaddle.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\Orden de compra #8730.exe
      "C:\Users\Admin\AppData\Local\Temp\Orden de compra #8730.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\stoRXAe.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2880
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\stoRXAe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDCF7.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2492
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2536
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:1636
      • C:\Windows\SysWOW64\wlanext.exe
        "C:\Windows\SysWOW64\wlanext.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:552
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
            PID:1152

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpDCF7.tmp

              Filesize

              1KB

              MD5

              55d1b5a33317362d725e21a2fe685c4b

              SHA1

              d16dc3ffd0bbeec96c9bbcf928abc99fd566e7c1

              SHA256

              ac18c49e428fe0be73a3d1a2b221f1a94373a81bc3a3f8292951a87090b37a20

              SHA512

              5db128173610d918ae45b48d4f573a03f9cef65b612bb5d4a2ceae2979865c369511da3be2d228624703b743fca3ab228974deb2c41ab02b558c7f565aa57f8a

            • memory/552-32-0x0000000000080000-0x00000000000AF000-memory.dmp

              Filesize

              188KB

            • memory/552-29-0x00000000003D0000-0x00000000003E6000-memory.dmp

              Filesize

              88KB

            • memory/552-28-0x00000000003D0000-0x00000000003E6000-memory.dmp

              Filesize

              88KB

            • memory/552-30-0x0000000000080000-0x00000000000AF000-memory.dmp

              Filesize

              188KB

            • memory/552-31-0x0000000001E20000-0x0000000002123000-memory.dmp

              Filesize

              3.0MB

            • memory/552-37-0x0000000001BF0000-0x0000000001C84000-memory.dmp

              Filesize

              592KB

            • memory/1348-39-0x00000000040D0000-0x00000000041B6000-memory.dmp

              Filesize

              920KB

            • memory/1348-35-0x0000000007450000-0x00000000075A3000-memory.dmp

              Filesize

              1.3MB

            • memory/1348-38-0x0000000003ED0000-0x00000000040D0000-memory.dmp

              Filesize

              2.0MB

            • memory/1348-27-0x0000000007450000-0x00000000075A3000-memory.dmp

              Filesize

              1.3MB

            • memory/1348-45-0x00000000040D0000-0x00000000041B6000-memory.dmp

              Filesize

              920KB

            • memory/1348-47-0x00000000040D0000-0x00000000041B6000-memory.dmp

              Filesize

              920KB

            • memory/2536-17-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2536-15-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2536-25-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2536-26-0x0000000000190000-0x00000000001A5000-memory.dmp

              Filesize

              84KB

            • memory/2536-23-0x0000000000970000-0x0000000000C73000-memory.dmp

              Filesize

              3.0MB

            • memory/2536-21-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2536-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2548-6-0x00000000003C0000-0x00000000003D0000-memory.dmp

              Filesize

              64KB

            • memory/2548-3-0x0000000074560000-0x0000000074C4E000-memory.dmp

              Filesize

              6.9MB

            • memory/2548-7-0x0000000005A50000-0x0000000005ABE000-memory.dmp

              Filesize

              440KB

            • memory/2548-1-0x00000000001E0000-0x0000000000278000-memory.dmp

              Filesize

              608KB

            • memory/2548-2-0x00000000049E0000-0x0000000004A20000-memory.dmp

              Filesize

              256KB

            • memory/2548-0-0x0000000074560000-0x0000000074C4E000-memory.dmp

              Filesize

              6.9MB

            • memory/2548-22-0x0000000074560000-0x0000000074C4E000-memory.dmp

              Filesize

              6.9MB

            • memory/2548-5-0x00000000049E0000-0x0000000004A20000-memory.dmp

              Filesize

              256KB

            • memory/2548-4-0x0000000000280000-0x0000000000296000-memory.dmp

              Filesize

              88KB

            • memory/2880-36-0x00000000025A0000-0x00000000025E0000-memory.dmp

              Filesize

              256KB

            • memory/2880-41-0x0000000073770000-0x0000000073D1B000-memory.dmp

              Filesize

              5.7MB

            • memory/2880-42-0x00000000025A0000-0x00000000025E0000-memory.dmp

              Filesize

              256KB

            • memory/2880-43-0x0000000073770000-0x0000000073D1B000-memory.dmp

              Filesize

              5.7MB

            • memory/2880-44-0x00000000025A0000-0x00000000025E0000-memory.dmp

              Filesize

              256KB

            • memory/2880-34-0x0000000073770000-0x0000000073D1B000-memory.dmp

              Filesize

              5.7MB

            • memory/2880-46-0x00000000025A0000-0x00000000025E0000-memory.dmp

              Filesize

              256KB

            • memory/2880-33-0x0000000073770000-0x0000000073D1B000-memory.dmp

              Filesize

              5.7MB

            • memory/2880-49-0x00000000025A0000-0x00000000025E0000-memory.dmp

              Filesize

              256KB

            • memory/2880-50-0x00000000025A0000-0x00000000025E0000-memory.dmp

              Filesize

              256KB

            • memory/2880-53-0x0000000073770000-0x0000000073D1B000-memory.dmp

              Filesize

              5.7MB