Analysis

  • max time kernel
    147s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2023, 11:33

General

  • Target

    Payment Copy (MT103 _03 _171023)_pdf.exe

  • Size

    592KB

  • MD5

    a57ad3a116cc0b544c63e7655047570f

  • SHA1

    0729e7e1300ab2b0fa9cf60d32cd2a15276a1f87

  • SHA256

    25e8610d483e74bac4bfc7189060e7fdeed775f6e82cd69b3a36d1a12b4e2af9

  • SHA512

    16af9ccb2a0e59d5c16469b219a2ffba7b3963e83da889a9277b2803714dabe5367b820edf18d9908d2e4f1d28eadd69b0eda1a055e9cf5b10a11eea8d4cb15a

  • SSDEEP

    12288:p//s02mvB+6ld9l/5ReV2fqy+/xCEL9HJfC/6afTTpcmUbgR/mZRM+:p//Z2mJ9p2hzhppqDrTpEgkZR5

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

eg02

Decoy

erc20.gold

elainevannmorgan.photography

melbet-el4.top

guvenilir.bet

sesamecsre.com

kevinjaydenwivano.tech

condohotelguru.com

shjcdz.com

innocarta.store

collinstradingpost.com

6om3j4.top

nagtco.xyz

fasist.fit

arkansaspremiertournaments.com

mrscsnowschool.com

ma-group.online

lillyjriley.icu

electric-cars-87253.bond

lila.tools

hollamia.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 5 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2320
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:2908
      • C:\Windows\SysWOW64\wlanext.exe
        "C:\Windows\SysWOW64\wlanext.exe"
        2⤵
          PID:2732
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\SysWOW64\netsh.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1048
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"
            3⤵
            • Deletes itself
            PID:2604

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1048-27-0x00000000013E0000-0x00000000013FB000-memory.dmp

              Filesize

              108KB

            • memory/1048-34-0x0000000000AD0000-0x0000000000B63000-memory.dmp

              Filesize

              588KB

            • memory/1048-31-0x0000000000080000-0x00000000000AF000-memory.dmp

              Filesize

              188KB

            • memory/1048-30-0x0000000000B70000-0x0000000000E73000-memory.dmp

              Filesize

              3.0MB

            • memory/1048-29-0x0000000000080000-0x00000000000AF000-memory.dmp

              Filesize

              188KB

            • memory/1048-28-0x00000000013E0000-0x00000000013FB000-memory.dmp

              Filesize

              108KB

            • memory/1216-17-0x0000000000010000-0x0000000000020000-memory.dmp

              Filesize

              64KB

            • memory/1216-19-0x0000000006390000-0x00000000064D4000-memory.dmp

              Filesize

              1.3MB

            • memory/1216-38-0x00000000073B0000-0x00000000074E8000-memory.dmp

              Filesize

              1.2MB

            • memory/1216-36-0x00000000073B0000-0x00000000074E8000-memory.dmp

              Filesize

              1.2MB

            • memory/1216-35-0x00000000073B0000-0x00000000074E8000-memory.dmp

              Filesize

              1.2MB

            • memory/1216-32-0x0000000006870000-0x000000000694C000-memory.dmp

              Filesize

              880KB

            • memory/1216-26-0x0000000006390000-0x00000000064D4000-memory.dmp

              Filesize

              1.3MB

            • memory/1216-25-0x0000000006870000-0x000000000694C000-memory.dmp

              Filesize

              880KB

            • memory/1216-24-0x0000000004170000-0x0000000004370000-memory.dmp

              Filesize

              2.0MB

            • memory/2320-22-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2320-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2320-18-0x0000000000370000-0x0000000000384000-memory.dmp

              Filesize

              80KB

            • memory/2320-9-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2320-10-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2320-23-0x00000000003B0000-0x00000000003C4000-memory.dmp

              Filesize

              80KB

            • memory/2320-16-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2320-14-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

              Filesize

              3.0MB

            • memory/2320-13-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2344-6-0x00000000009C0000-0x0000000000A00000-memory.dmp

              Filesize

              256KB

            • memory/2344-5-0x0000000074260000-0x000000007494E000-memory.dmp

              Filesize

              6.9MB

            • memory/2344-4-0x0000000000430000-0x000000000043C000-memory.dmp

              Filesize

              48KB

            • memory/2344-3-0x0000000000480000-0x000000000049C000-memory.dmp

              Filesize

              112KB

            • memory/2344-2-0x00000000009C0000-0x0000000000A00000-memory.dmp

              Filesize

              256KB

            • memory/2344-0-0x0000000000080000-0x000000000011A000-memory.dmp

              Filesize

              616KB

            • memory/2344-1-0x0000000074260000-0x000000007494E000-memory.dmp

              Filesize

              6.9MB

            • memory/2344-7-0x00000000004A0000-0x00000000004B0000-memory.dmp

              Filesize

              64KB

            • memory/2344-20-0x0000000074260000-0x000000007494E000-memory.dmp

              Filesize

              6.9MB

            • memory/2344-8-0x0000000005ED0000-0x0000000005F3E000-memory.dmp

              Filesize

              440KB