Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2023, 12:22

General

  • Target

    Payment Copy (MT103 _03 _171023)_pdf.exe

  • Size

    592KB

  • MD5

    a57ad3a116cc0b544c63e7655047570f

  • SHA1

    0729e7e1300ab2b0fa9cf60d32cd2a15276a1f87

  • SHA256

    25e8610d483e74bac4bfc7189060e7fdeed775f6e82cd69b3a36d1a12b4e2af9

  • SHA512

    16af9ccb2a0e59d5c16469b219a2ffba7b3963e83da889a9277b2803714dabe5367b820edf18d9908d2e4f1d28eadd69b0eda1a055e9cf5b10a11eea8d4cb15a

  • SSDEEP

    12288:p//s02mvB+6ld9l/5ReV2fqy+/xCEL9HJfC/6afTTpcmUbgR/mZRM+:p//Z2mJ9p2hzhppqDrTpEgkZR5

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

eg02

Decoy

erc20.gold

elainevannmorgan.photography

melbet-el4.top

guvenilir.bet

sesamecsre.com

kevinjaydenwivano.tech

condohotelguru.com

shjcdz.com

innocarta.store

collinstradingpost.com

6om3j4.top

nagtco.xyz

fasist.fit

arkansaspremiertournaments.com

mrscsnowschool.com

ma-group.online

lillyjriley.icu

electric-cars-87253.bond

lila.tools

hollamia.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2760
    • C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\SysWOW64\chkdsk.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Payment Copy (MT103 _03 _171023)_pdf.exe"
        3⤵
        • Deletes itself
        PID:2720

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1264-34-0x00000000039A0000-0x0000000003A3C000-memory.dmp

          Filesize

          624KB

        • memory/1264-22-0x0000000004E40000-0x0000000004F61000-memory.dmp

          Filesize

          1.1MB

        • memory/1264-28-0x0000000004E40000-0x0000000004F61000-memory.dmp

          Filesize

          1.1MB

        • memory/1264-31-0x00000000039A0000-0x0000000003A3C000-memory.dmp

          Filesize

          624KB

        • memory/1264-20-0x0000000000010000-0x0000000000020000-memory.dmp

          Filesize

          64KB

        • memory/1264-32-0x00000000039A0000-0x0000000003A3C000-memory.dmp

          Filesize

          624KB

        • memory/2176-4-0x0000000000380000-0x000000000038C000-memory.dmp

          Filesize

          48KB

        • memory/2176-7-0x0000000000390000-0x00000000003A0000-memory.dmp

          Filesize

          64KB

        • memory/2176-8-0x000000000D300000-0x000000000D36E000-memory.dmp

          Filesize

          440KB

        • memory/2176-6-0x0000000004F20000-0x0000000004F60000-memory.dmp

          Filesize

          256KB

        • memory/2176-5-0x0000000074060000-0x000000007474E000-memory.dmp

          Filesize

          6.9MB

        • memory/2176-3-0x0000000000360000-0x000000000037C000-memory.dmp

          Filesize

          112KB

        • memory/2176-2-0x0000000004F20000-0x0000000004F60000-memory.dmp

          Filesize

          256KB

        • memory/2176-16-0x0000000074060000-0x000000007474E000-memory.dmp

          Filesize

          6.9MB

        • memory/2176-0-0x00000000008C0000-0x000000000095A000-memory.dmp

          Filesize

          616KB

        • memory/2176-1-0x0000000074060000-0x000000007474E000-memory.dmp

          Filesize

          6.9MB

        • memory/2600-25-0x0000000000080000-0x00000000000AF000-memory.dmp

          Filesize

          188KB

        • memory/2600-23-0x0000000000FC0000-0x0000000000FC7000-memory.dmp

          Filesize

          28KB

        • memory/2600-24-0x0000000000FC0000-0x0000000000FC7000-memory.dmp

          Filesize

          28KB

        • memory/2600-26-0x0000000000C40000-0x0000000000F43000-memory.dmp

          Filesize

          3.0MB

        • memory/2600-27-0x0000000000080000-0x00000000000AF000-memory.dmp

          Filesize

          188KB

        • memory/2600-30-0x0000000000AD0000-0x0000000000B63000-memory.dmp

          Filesize

          588KB

        • memory/2760-21-0x00000000001D0000-0x00000000001E4000-memory.dmp

          Filesize

          80KB

        • memory/2760-19-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2760-17-0x0000000000960000-0x0000000000C63000-memory.dmp

          Filesize

          3.0MB

        • memory/2760-15-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2760-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2760-11-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2760-9-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB