Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2023, 10:32

General

  • Target

    ახალი შესყიდვის შეკვეთა pdf.exe

  • Size

    658KB

  • MD5

    f891581195d4a3eb2b70d8dd5b7e2fa7

  • SHA1

    ce7058980b99c9c53ef77361e27848a2c31901cf

  • SHA256

    ec631a873ad900f187bc34ba3d92c950ac3d20949147104414e03096a703cc64

  • SHA512

    f9791f466a1434ac754117e9bf46a22c6b2dd541fcd8bacce331184fa12886114915978f2c8a8eb3ca18a0a1273a334b975af01c9be0e7f1632c4d08ed6c7f7d

  • SSDEEP

    12288:3MgFWMjgR/mZRM+ByVw9yFgbuFZMlfJJT4nhLqOxLSRPQ12WAGTeoWIGmpqNN:jjgkZR5YbOwZMtLchWOxLSRPQDHTDxu/

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g11y

Decoy

bayivip.top

lunarrhythmsliving.com

elizabethanbello.art

plushkitchen.com

timedb.net

exploringaging.com

dreamoney.online

luvisusllc.com

strikemedialabs.com

belvederesportsclub.com

turteen.com

theofficialtrumpcards.com

x-y-z.online

otuvu.com

outhandsbpm.com

scabiosa.top

99job.store

afcxz80whz.com

mysrz3l47.top

sarekaonsaddle.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\ახალი შესყიდვის შეკვეთა pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\ახალი შესყიდვის შეკვეთა pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2196
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\idScXbUauEgmY.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2748
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\idScXbUauEgmY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3256.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2740
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2652
    • C:\Windows\SysWOW64\colorcpl.exe
      "C:\Windows\SysWOW64\colorcpl.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:3024

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmp3256.tmp

            Filesize

            1KB

            MD5

            caa4e40e83f73f2850c1b7c00ab4945d

            SHA1

            5c488229c34363568e52975606b4457c20d70dae

            SHA256

            53544c962ee5e26a3bdb2fd8a59c1025e7330dabf43b2a7cc94516340aba8f28

            SHA512

            4ecf1390054246ba493b93e4a063046934e1baa250b17c838fe9dd13443d07ecec875b0ded8b47915898d496ef0473b477eac439db3d2ada14dc01a2c8c88c3e

          • memory/1260-41-0x0000000004B40000-0x0000000004BE6000-memory.dmp

            Filesize

            664KB

          • memory/1260-42-0x0000000004B40000-0x0000000004BE6000-memory.dmp

            Filesize

            664KB

          • memory/1260-30-0x0000000006C40000-0x0000000006D8A000-memory.dmp

            Filesize

            1.3MB

          • memory/1260-44-0x0000000004B40000-0x0000000004BE6000-memory.dmp

            Filesize

            664KB

          • memory/2196-3-0x0000000001DC0000-0x0000000001DDC000-memory.dmp

            Filesize

            112KB

          • memory/2196-6-0x0000000004C40000-0x0000000004C80000-memory.dmp

            Filesize

            256KB

          • memory/2196-7-0x0000000001DE0000-0x0000000001DF0000-memory.dmp

            Filesize

            64KB

          • memory/2196-8-0x0000000004F30000-0x0000000004F9E000-memory.dmp

            Filesize

            440KB

          • memory/2196-5-0x00000000744E0000-0x0000000074BCE000-memory.dmp

            Filesize

            6.9MB

          • memory/2196-4-0x00000000008F0000-0x00000000008FC000-memory.dmp

            Filesize

            48KB

          • memory/2196-2-0x0000000004C40000-0x0000000004C80000-memory.dmp

            Filesize

            256KB

          • memory/2196-0-0x0000000000900000-0x00000000009AA000-memory.dmp

            Filesize

            680KB

          • memory/2196-1-0x00000000744E0000-0x0000000074BCE000-memory.dmp

            Filesize

            6.9MB

          • memory/2196-23-0x00000000744E0000-0x0000000074BCE000-memory.dmp

            Filesize

            6.9MB

          • memory/2524-34-0x0000000000050000-0x0000000000068000-memory.dmp

            Filesize

            96KB

          • memory/2524-35-0x0000000000050000-0x0000000000068000-memory.dmp

            Filesize

            96KB

          • memory/2524-40-0x0000000001D90000-0x0000000001E24000-memory.dmp

            Filesize

            592KB

          • memory/2524-38-0x00000000000A0000-0x00000000000CF000-memory.dmp

            Filesize

            188KB

          • memory/2524-37-0x0000000001F20000-0x0000000002223000-memory.dmp

            Filesize

            3.0MB

          • memory/2524-36-0x00000000000A0000-0x00000000000CF000-memory.dmp

            Filesize

            188KB

          • memory/2652-22-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2652-32-0x0000000000800000-0x0000000000B03000-memory.dmp

            Filesize

            3.0MB

          • memory/2652-29-0x0000000000320000-0x0000000000335000-memory.dmp

            Filesize

            84KB

          • memory/2652-28-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2652-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2652-18-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2652-16-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2748-26-0x00000000024F0000-0x0000000002530000-memory.dmp

            Filesize

            256KB

          • memory/2748-33-0x000000006E970000-0x000000006EF1B000-memory.dmp

            Filesize

            5.7MB

          • memory/2748-25-0x000000006E970000-0x000000006EF1B000-memory.dmp

            Filesize

            5.7MB

          • memory/2748-31-0x00000000024F0000-0x0000000002530000-memory.dmp

            Filesize

            256KB

          • memory/2748-27-0x000000006E970000-0x000000006EF1B000-memory.dmp

            Filesize

            5.7MB