Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 13:32

General

  • Target

    PO8687.exe

  • Size

    761KB

  • MD5

    9daa7adc7435c5e080c99f2239017e27

  • SHA1

    70b63b6a205b277367be62cfbfc9e528c5b1903a

  • SHA256

    1d18b8139377bf5246b24fd11e4386312cc4ab3e652ab9df534068ac96755394

  • SHA512

    78e36c18660004fdaf3b8b07fa0b47ece8323b170c2fdd66e75efe88e4dfa46c7dc06fbcf9f08eccdf455e5fe7aeb083fc8191b2511588ee851811999a3fefd7

  • SSDEEP

    12288:hhNh6sxTA6qNhtnaRi+glMjYTabQ0IFpRxwkn+RuB3SJ:hDDxs6g7aRi+/YTabQ0ktwk+cB

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ro12

Decoy

start399.com

decyfincoin.com

binguozhijiaok.com

one45.vip

55dy5s.top

regmt.pro

2ahxgaafifl.com

xn--6rtp2flvfc2h.com

justinmburns.com

los3.online

fleshaaikensdivinegiven7llc.com

servicedelv.services

apexcaryhomesforsale.com

shuraop.xyz

sagetotal.com

gratitude-et-compagnie.com

riderarea.com

digitalserviceact.online

contentbyc.com

agenda-digital-planner.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3136
    • C:\Users\Admin\AppData\Local\Temp\PO8687.exe
      "C:\Users\Admin\AppData\Local\Temp\PO8687.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4868
      • C:\Users\Admin\AppData\Local\Temp\PO8687.exe
        "C:\Users\Admin\AppData\Local\Temp\PO8687.exe"
        3⤵
          PID:3432
        • C:\Users\Admin\AppData\Local\Temp\PO8687.exe
          "C:\Users\Admin\AppData\Local\Temp\PO8687.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:380
      • C:\Windows\SysWOW64\ipconfig.exe
        "C:\Windows\SysWOW64\ipconfig.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Gathers network information
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\PO8687.exe"
          3⤵
            PID:3176

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/380-16-0x0000000001A60000-0x0000000001DAA000-memory.dmp

              Filesize

              3.3MB

            • memory/380-18-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/380-13-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/380-19-0x00000000016D0000-0x00000000016E4000-memory.dmp

              Filesize

              80KB

            • memory/2404-22-0x00000000004C0000-0x00000000004CB000-memory.dmp

              Filesize

              44KB

            • memory/2404-25-0x00000000008C0000-0x00000000008EF000-memory.dmp

              Filesize

              188KB

            • memory/2404-24-0x0000000001170000-0x00000000014BA000-memory.dmp

              Filesize

              3.3MB

            • memory/2404-23-0x00000000008C0000-0x00000000008EF000-memory.dmp

              Filesize

              188KB

            • memory/2404-28-0x0000000000F80000-0x0000000001013000-memory.dmp

              Filesize

              588KB

            • memory/2404-21-0x00000000004C0000-0x00000000004CB000-memory.dmp

              Filesize

              44KB

            • memory/3136-26-0x0000000008D30000-0x0000000008EB5000-memory.dmp

              Filesize

              1.5MB

            • memory/3136-20-0x0000000008D30000-0x0000000008EB5000-memory.dmp

              Filesize

              1.5MB

            • memory/3136-29-0x000000000A5F0000-0x000000000A70B000-memory.dmp

              Filesize

              1.1MB

            • memory/3136-30-0x000000000A5F0000-0x000000000A70B000-memory.dmp

              Filesize

              1.1MB

            • memory/3136-32-0x000000000A5F0000-0x000000000A70B000-memory.dmp

              Filesize

              1.1MB

            • memory/4868-7-0x00000000054B0000-0x00000000054BC000-memory.dmp

              Filesize

              48KB

            • memory/4868-15-0x00000000748C0000-0x0000000075070000-memory.dmp

              Filesize

              7.7MB

            • memory/4868-12-0x000000000ED20000-0x000000000EDBC000-memory.dmp

              Filesize

              624KB

            • memory/4868-11-0x000000000BC10000-0x000000000BC7E000-memory.dmp

              Filesize

              440KB

            • memory/4868-10-0x00000000057C0000-0x00000000057D0000-memory.dmp

              Filesize

              64KB

            • memory/4868-9-0x00000000055C0000-0x00000000055D0000-memory.dmp

              Filesize

              64KB

            • memory/4868-8-0x00000000748C0000-0x0000000075070000-memory.dmp

              Filesize

              7.7MB

            • memory/4868-0-0x0000000000960000-0x0000000000A24000-memory.dmp

              Filesize

              784KB

            • memory/4868-6-0x0000000005540000-0x000000000555C000-memory.dmp

              Filesize

              112KB

            • memory/4868-5-0x00000000054C0000-0x00000000054CA000-memory.dmp

              Filesize

              40KB

            • memory/4868-4-0x00000000055C0000-0x00000000055D0000-memory.dmp

              Filesize

              64KB

            • memory/4868-3-0x0000000005400000-0x0000000005492000-memory.dmp

              Filesize

              584KB

            • memory/4868-2-0x00000000058B0000-0x0000000005E54000-memory.dmp

              Filesize

              5.6MB

            • memory/4868-1-0x00000000748C0000-0x0000000075070000-memory.dmp

              Filesize

              7.7MB