Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2023, 16:17

General

  • Target

    NEAS.0f6bd3f07adcb52e4e0a94d3fcc307b0780cdcd2e02ff3640474cd32303b898bexe_JC.exe

  • Size

    635KB

  • MD5

    329d62d6721d26d80cbad1ea1bc0fabb

  • SHA1

    8f5b7cd1fb8190b04c5075082d7d86628f93c664

  • SHA256

    0f6bd3f07adcb52e4e0a94d3fcc307b0780cdcd2e02ff3640474cd32303b898b

  • SHA512

    24a2334c55a1049f1a194e7fb6810d0037a97962d88c5544dd1f1073e01514131b9839aaf68d32900a2704709823ec8bf4b770327c1f229920a560dca5475167

  • SSDEEP

    12288:cZ7s9IwQ2FBf6J0lJda/LGvgZ8l7gXipJ6l+8OAMtcjd:cZ7s9IlkfmXZ8KSzwTOAgcjd

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ey16

Decoy

slimshotonline.com

rifaboa.com

metallzauber.com

jabandfuel.com

reacthat.com

qcgaeu.top

ssongg446.cfd

29kuan7.cfd

101agh.com

reliablii.com

luginfinity.com

e513.cloud

k4lantar.sbs

etoempire.com

phons.info

vovacom.com

birbakalim.fun

wellhousesctx.com

flthg.link

strasburgangus.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 5 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\NEAS.0f6bd3f07adcb52e4e0a94d3fcc307b0780cdcd2e02ff3640474cd32303b898bexe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.0f6bd3f07adcb52e4e0a94d3fcc307b0780cdcd2e02ff3640474cd32303b898bexe_JC.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HQgFNd.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2840
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HQgFNd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF151.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2736
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2552
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:564
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2628

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmpF151.tmp

            Filesize

            1KB

            MD5

            34228ce51b7ab202e733dc15a22b57d3

            SHA1

            fb8eb8b9fe01d5219e9d7f2f357de8ab54449663

            SHA256

            c95b5606d9573d67ed9f7aace0ba7f65f3528b9240a9ef9e8842e9c10fa28911

            SHA512

            980ddef85691d6c1011e28c461f04d8f041958927f65f8ad216cc4161eedb546a2ac81d84e964a1995da257b356c867189bc5ee726bee47d17e773384851c171

          • memory/564-39-0x0000000000CF0000-0x0000000000D0C000-memory.dmp

            Filesize

            112KB

          • memory/564-40-0x0000000000CF0000-0x0000000000D0C000-memory.dmp

            Filesize

            112KB

          • memory/564-41-0x0000000000080000-0x00000000000AF000-memory.dmp

            Filesize

            188KB

          • memory/564-42-0x0000000002110000-0x0000000002413000-memory.dmp

            Filesize

            3.0MB

          • memory/564-44-0x0000000000080000-0x00000000000AF000-memory.dmp

            Filesize

            188KB

          • memory/564-46-0x0000000000860000-0x00000000008F4000-memory.dmp

            Filesize

            592KB

          • memory/1168-5-0x0000000005050000-0x0000000005090000-memory.dmp

            Filesize

            256KB

          • memory/1168-23-0x00000000744F0000-0x0000000074BDE000-memory.dmp

            Filesize

            6.9MB

          • memory/1168-1-0x00000000744F0000-0x0000000074BDE000-memory.dmp

            Filesize

            6.9MB

          • memory/1168-0-0x0000000000CF0000-0x0000000000D94000-memory.dmp

            Filesize

            656KB

          • memory/1168-6-0x0000000000480000-0x0000000000490000-memory.dmp

            Filesize

            64KB

          • memory/1168-2-0x0000000005050000-0x0000000005090000-memory.dmp

            Filesize

            256KB

          • memory/1168-3-0x0000000000510000-0x0000000000528000-memory.dmp

            Filesize

            96KB

          • memory/1168-7-0x0000000005090000-0x00000000050FE000-memory.dmp

            Filesize

            440KB

          • memory/1168-4-0x00000000744F0000-0x0000000074BDE000-memory.dmp

            Filesize

            6.9MB

          • memory/1232-43-0x0000000007150000-0x0000000007272000-memory.dmp

            Filesize

            1.1MB

          • memory/1232-33-0x0000000006600000-0x00000000066BA000-memory.dmp

            Filesize

            744KB

          • memory/1232-47-0x0000000009290000-0x00000000093FA000-memory.dmp

            Filesize

            1.4MB

          • memory/1232-38-0x0000000006600000-0x00000000066BA000-memory.dmp

            Filesize

            744KB

          • memory/1232-37-0x0000000007150000-0x0000000007272000-memory.dmp

            Filesize

            1.1MB

          • memory/1232-31-0x0000000002EB0000-0x0000000002FB0000-memory.dmp

            Filesize

            1024KB

          • memory/2552-15-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2552-26-0x0000000000860000-0x0000000000B63000-memory.dmp

            Filesize

            3.0MB

          • memory/2552-36-0x00000000002F0000-0x0000000000305000-memory.dmp

            Filesize

            84KB

          • memory/2552-35-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2552-30-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2552-17-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2552-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2552-32-0x00000000001A0000-0x00000000001B5000-memory.dmp

            Filesize

            84KB

          • memory/2552-21-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2840-24-0x000000006E3C0000-0x000000006E96B000-memory.dmp

            Filesize

            5.7MB

          • memory/2840-22-0x000000006E3C0000-0x000000006E96B000-memory.dmp

            Filesize

            5.7MB

          • memory/2840-25-0x0000000001E70000-0x0000000001EB0000-memory.dmp

            Filesize

            256KB

          • memory/2840-27-0x0000000001E70000-0x0000000001EB0000-memory.dmp

            Filesize

            256KB

          • memory/2840-29-0x000000006E3C0000-0x000000006E96B000-memory.dmp

            Filesize

            5.7MB