Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2023, 17:41

General

  • Target

    NEAS.9d507d3f7b58d898ff10eb7443b6feb32ea2ea6972d3ceafa67e2e0a1d0504feexe_JC.exe

  • Size

    575KB

  • MD5

    c1feb44ae338eb00dbe923fd56d5a18a

  • SHA1

    26e1bc57820890dff65966d74f66019403fadcdd

  • SHA256

    9d507d3f7b58d898ff10eb7443b6feb32ea2ea6972d3ceafa67e2e0a1d0504fe

  • SHA512

    fff511f1e1031adfc3cd9457298ff5e1ef16201200b6ad1a769331a3d915a18ced09d82b32e3fd3f2e8556a5f85fab5d04a2114349a09850a72325b4fbddcc82

  • SSDEEP

    12288:E/jNu5VoGUpQCYaSm2KuJPkoF+KUr94xsJwQZG588YrX10/4:ELNu5Vo2CYaRBuJPkoUpp4s85

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

k0p2

Decoy

theluxurytraveljournal.com

skybet10.com

mountruqal.online

onlyones.xyz

kloea.top

studio7crochet.online

dhv9gmy.top

walkereld.com

script-shore.com

bwerger02.xyz

clempi.xyz

lishapanchal.com

imagemaza.com

ludu65.com

zenith-leadership.com

undertheradar.zone

802cm.top

budeny.com

piabellacasino338.com

eclipse-demolition.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.9d507d3f7b58d898ff10eb7443b6feb32ea2ea6972d3ceafa67e2e0a1d0504feexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9d507d3f7b58d898ff10eb7443b6feb32ea2ea6972d3ceafa67e2e0a1d0504feexe_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Users\Admin\AppData\Local\Temp\NEAS.9d507d3f7b58d898ff10eb7443b6feb32ea2ea6972d3ceafa67e2e0a1d0504feexe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9d507d3f7b58d898ff10eb7443b6feb32ea2ea6972d3ceafa67e2e0a1d0504feexe_JC.exe"
      2⤵
        PID:2632
      • C:\Users\Admin\AppData\Local\Temp\NEAS.9d507d3f7b58d898ff10eb7443b6feb32ea2ea6972d3ceafa67e2e0a1d0504feexe_JC.exe
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9d507d3f7b58d898ff10eb7443b6feb32ea2ea6972d3ceafa67e2e0a1d0504feexe_JC.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2512

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/812-6-0x0000000000450000-0x0000000000460000-memory.dmp

            Filesize

            64KB

          • memory/812-15-0x0000000073ED0000-0x00000000745BE000-memory.dmp

            Filesize

            6.9MB

          • memory/812-2-0x00000000049F0000-0x0000000004A30000-memory.dmp

            Filesize

            256KB

          • memory/812-3-0x0000000000470000-0x0000000000488000-memory.dmp

            Filesize

            96KB

          • memory/812-4-0x0000000073ED0000-0x00000000745BE000-memory.dmp

            Filesize

            6.9MB

          • memory/812-5-0x00000000049F0000-0x0000000004A30000-memory.dmp

            Filesize

            256KB

          • memory/812-7-0x0000000004E10000-0x0000000004E7E000-memory.dmp

            Filesize

            440KB

          • memory/812-0-0x00000000002C0000-0x0000000000356000-memory.dmp

            Filesize

            600KB

          • memory/812-1-0x0000000073ED0000-0x00000000745BE000-memory.dmp

            Filesize

            6.9MB

          • memory/2512-10-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2512-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2512-14-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2512-8-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2512-16-0x0000000000910000-0x0000000000C13000-memory.dmp

            Filesize

            3.0MB