Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 16:17

General

  • Target

    NEAS.0f6bd3f07adcb52e4e0a94d3fcc307b0780cdcd2e02ff3640474cd32303b898bexe_JC.exe

  • Size

    635KB

  • MD5

    329d62d6721d26d80cbad1ea1bc0fabb

  • SHA1

    8f5b7cd1fb8190b04c5075082d7d86628f93c664

  • SHA256

    0f6bd3f07adcb52e4e0a94d3fcc307b0780cdcd2e02ff3640474cd32303b898b

  • SHA512

    24a2334c55a1049f1a194e7fb6810d0037a97962d88c5544dd1f1073e01514131b9839aaf68d32900a2704709823ec8bf4b770327c1f229920a560dca5475167

  • SSDEEP

    12288:cZ7s9IwQ2FBf6J0lJda/LGvgZ8l7gXipJ6l+8OAMtcjd:cZ7s9IlkfmXZ8KSzwTOAgcjd

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ey16

Decoy

slimshotonline.com

rifaboa.com

metallzauber.com

jabandfuel.com

reacthat.com

qcgaeu.top

ssongg446.cfd

29kuan7.cfd

101agh.com

reliablii.com

luginfinity.com

e513.cloud

k4lantar.sbs

etoempire.com

phons.info

vovacom.com

birbakalim.fun

wellhousesctx.com

flthg.link

strasburgangus.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3204
    • C:\Users\Admin\AppData\Local\Temp\NEAS.0f6bd3f07adcb52e4e0a94d3fcc307b0780cdcd2e02ff3640474cd32303b898bexe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.0f6bd3f07adcb52e4e0a94d3fcc307b0780cdcd2e02ff3640474cd32303b898bexe_JC.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:700
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HQgFNd.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4976
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HQgFNd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A26.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:3516
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1512
    • C:\Windows\SysWOW64\WWAHost.exe
      "C:\Windows\SysWOW64\WWAHost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:4760

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uq42jslb.hkt.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\tmp3A26.tmp

            Filesize

            1KB

            MD5

            86765daf23d59204f72d1f7816fd60fa

            SHA1

            9cdd046e95614bcc2b825dabb43a0125a526e70c

            SHA256

            1ce03266b8398e4789a1a0adc82c28e1bbf721824afe3d5b14abf0699f8668cf

            SHA512

            c2091074da5e3a585f5b8d1db4dcd649ccde86e660ab5c4878c4df8405afccd62d7ae89a2ccf0611506a1ecef7805d49c7c0cf92c04ce4f97b8b6b4c1a22d433

          • memory/700-10-0x0000000007EA0000-0x0000000007F0E000-memory.dmp

            Filesize

            440KB

          • memory/700-11-0x000000000A5E0000-0x000000000A67C000-memory.dmp

            Filesize

            624KB

          • memory/700-4-0x00000000056D0000-0x00000000056E0000-memory.dmp

            Filesize

            64KB

          • memory/700-5-0x0000000005420000-0x000000000542A000-memory.dmp

            Filesize

            40KB

          • memory/700-6-0x0000000005690000-0x00000000056A8000-memory.dmp

            Filesize

            96KB

          • memory/700-7-0x0000000075140000-0x00000000758F0000-memory.dmp

            Filesize

            7.7MB

          • memory/700-8-0x00000000056D0000-0x00000000056E0000-memory.dmp

            Filesize

            64KB

          • memory/700-9-0x00000000056B0000-0x00000000056C0000-memory.dmp

            Filesize

            64KB

          • memory/700-3-0x0000000005490000-0x0000000005522000-memory.dmp

            Filesize

            584KB

          • memory/700-0-0x0000000000990000-0x0000000000A34000-memory.dmp

            Filesize

            656KB

          • memory/700-24-0x0000000075140000-0x00000000758F0000-memory.dmp

            Filesize

            7.7MB

          • memory/700-1-0x0000000075140000-0x00000000758F0000-memory.dmp

            Filesize

            7.7MB

          • memory/700-2-0x0000000005A40000-0x0000000005FE4000-memory.dmp

            Filesize

            5.6MB

          • memory/1512-40-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/1512-21-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/1512-38-0x0000000000FD0000-0x000000000131A000-memory.dmp

            Filesize

            3.3MB

          • memory/1512-41-0x0000000000B00000-0x0000000000B15000-memory.dmp

            Filesize

            84KB

          • memory/3204-80-0x0000000009120000-0x00000000091EE000-memory.dmp

            Filesize

            824KB

          • memory/3204-83-0x0000000008D60000-0x0000000008E87000-memory.dmp

            Filesize

            1.2MB

          • memory/3204-84-0x0000000008D60000-0x0000000008E87000-memory.dmp

            Filesize

            1.2MB

          • memory/3204-86-0x0000000008D60000-0x0000000008E87000-memory.dmp

            Filesize

            1.2MB

          • memory/3204-42-0x0000000009120000-0x00000000091EE000-memory.dmp

            Filesize

            824KB

          • memory/3948-82-0x0000000001630000-0x00000000016C4000-memory.dmp

            Filesize

            592KB

          • memory/3948-79-0x0000000000810000-0x000000000083F000-memory.dmp

            Filesize

            188KB

          • memory/3948-71-0x00000000018A0000-0x0000000001BEA000-memory.dmp

            Filesize

            3.3MB

          • memory/3948-67-0x0000000000810000-0x000000000083F000-memory.dmp

            Filesize

            188KB

          • memory/3948-62-0x00000000008F0000-0x00000000009CC000-memory.dmp

            Filesize

            880KB

          • memory/3948-64-0x00000000008F0000-0x00000000009CC000-memory.dmp

            Filesize

            880KB

          • memory/4976-17-0x0000000075140000-0x00000000758F0000-memory.dmp

            Filesize

            7.7MB

          • memory/4976-45-0x0000000004D20000-0x0000000004D30000-memory.dmp

            Filesize

            64KB

          • memory/4976-46-0x0000000006910000-0x0000000006942000-memory.dmp

            Filesize

            200KB

          • memory/4976-47-0x0000000071A00000-0x0000000071A4C000-memory.dmp

            Filesize

            304KB

          • memory/4976-57-0x00000000068F0000-0x000000000690E000-memory.dmp

            Filesize

            120KB

          • memory/4976-58-0x0000000007320000-0x00000000073C3000-memory.dmp

            Filesize

            652KB

          • memory/4976-59-0x0000000007D30000-0x00000000083AA000-memory.dmp

            Filesize

            6.5MB

          • memory/4976-60-0x0000000007440000-0x000000000745A000-memory.dmp

            Filesize

            104KB

          • memory/4976-61-0x00000000076C0000-0x00000000076CA000-memory.dmp

            Filesize

            40KB

          • memory/4976-44-0x0000000006380000-0x00000000063CC000-memory.dmp

            Filesize

            304KB

          • memory/4976-43-0x0000000006340000-0x000000000635E000-memory.dmp

            Filesize

            120KB

          • memory/4976-65-0x00000000078D0000-0x0000000007966000-memory.dmp

            Filesize

            600KB

          • memory/4976-37-0x0000000005E20000-0x0000000006174000-memory.dmp

            Filesize

            3.3MB

          • memory/4976-66-0x0000000075140000-0x00000000758F0000-memory.dmp

            Filesize

            7.7MB

          • memory/4976-68-0x0000000004D20000-0x0000000004D30000-memory.dmp

            Filesize

            64KB

          • memory/4976-69-0x0000000007850000-0x0000000007861000-memory.dmp

            Filesize

            68KB

          • memory/4976-70-0x0000000004D20000-0x0000000004D30000-memory.dmp

            Filesize

            64KB

          • memory/4976-32-0x0000000005C30000-0x0000000005C96000-memory.dmp

            Filesize

            408KB

          • memory/4976-72-0x0000000007880000-0x000000000788E000-memory.dmp

            Filesize

            56KB

          • memory/4976-73-0x0000000007890000-0x00000000078A4000-memory.dmp

            Filesize

            80KB

          • memory/4976-74-0x0000000007990000-0x00000000079AA000-memory.dmp

            Filesize

            104KB

          • memory/4976-75-0x0000000007970000-0x0000000007978000-memory.dmp

            Filesize

            32KB

          • memory/4976-78-0x0000000075140000-0x00000000758F0000-memory.dmp

            Filesize

            7.7MB

          • memory/4976-31-0x0000000005BC0000-0x0000000005C26000-memory.dmp

            Filesize

            408KB

          • memory/4976-25-0x00000000052E0000-0x0000000005302000-memory.dmp

            Filesize

            136KB

          • memory/4976-22-0x00000000053A0000-0x00000000059C8000-memory.dmp

            Filesize

            6.2MB

          • memory/4976-19-0x0000000004D20000-0x0000000004D30000-memory.dmp

            Filesize

            64KB

          • memory/4976-20-0x0000000004D20000-0x0000000004D30000-memory.dmp

            Filesize

            64KB

          • memory/4976-16-0x0000000004D30000-0x0000000004D66000-memory.dmp

            Filesize

            216KB