Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2023, 16:47

General

  • Target

    NEAS.354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579exe_JC.exe

  • Size

    426KB

  • MD5

    df247bbfaf91dbe0da4d79a04cfb5ca3

  • SHA1

    0d29cbfa4b746e71c680bbd56a6c51964fd9b1fa

  • SHA256

    354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579

  • SHA512

    ea413b9f389b9bb2bd8eaca5c3917a656840df5d48c5fb5478d9b453412fe941229cae535df587a66996acb9b96a4c692491ebe65a106d35eb0b757d6412286b

  • SSDEEP

    6144:zfL+oqgoT3oPrD68F2PD44p8Ls1k7n82iKGI3TmBp6CbspK7M2jtsftCq9CPbz:zfLCT21oy82PGIC/Bb8K7MNCB/

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sy22

Decoy

vinteligencia.com

displayfridges.fun

completetip.com

giallozafferrano.com

jizihao1.com

mysticheightstrail.com

fourseasonslb.com

kjnala.shop

mosiacwall.com

vandistreet.com

gracefullytouchedartistry.com

hbiwhwr.shop

mfmz.net

hrmbrillianz.com

funwarsztat.com

polewithcandy.com

ourrajasthan.com

wilhouettteamerica.com

johnnystintshop.com

asgnelwin.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1364
    • C:\Users\Admin\AppData\Local\Temp\NEAS.354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579exe_JC.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe
        "C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2044
        • C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe
          "C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2636
    • C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\SysWOW64\chkdsk.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe"
        3⤵
          PID:2700

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\iomgmdsgtbq.p

            Filesize

            205KB

            MD5

            60d116c175aabe2c06bdd949a101127c

            SHA1

            63bb316383b4706d43f7882ee545031c4cac2505

            SHA256

            ee52d5afe32c612681d16c9bfee4cdb923ee5e54b84196b7b5ecc0aa4ad1df76

            SHA512

            d90f9148243101db90de1945854a9dd1e6aa6fd59ff0ccb1ff0053f7f91b8b40176a7d5401e63a5600474bfc8749733ff55cc76fa2094a697eb14726241a2fe9

          • C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe

            Filesize

            361KB

            MD5

            9e519a78d2ee0e4fa641187866bc9703

            SHA1

            549dc42c936b4bc2612c20c668f94b37bb5163cc

            SHA256

            c54c9db30df0d4fc34dcb8fece51fe3089d38283665cdd5af2c4846fa26f8e26

            SHA512

            a04afae9d0a2143f4ea5d1754fb1b162571275af935fda205d327765c1181d235a13d76bd204b2517d0a100c58956bd47880f8aad1d8da1b9bc5c8691e80a92c

          • C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe

            Filesize

            361KB

            MD5

            9e519a78d2ee0e4fa641187866bc9703

            SHA1

            549dc42c936b4bc2612c20c668f94b37bb5163cc

            SHA256

            c54c9db30df0d4fc34dcb8fece51fe3089d38283665cdd5af2c4846fa26f8e26

            SHA512

            a04afae9d0a2143f4ea5d1754fb1b162571275af935fda205d327765c1181d235a13d76bd204b2517d0a100c58956bd47880f8aad1d8da1b9bc5c8691e80a92c

          • C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe

            Filesize

            361KB

            MD5

            9e519a78d2ee0e4fa641187866bc9703

            SHA1

            549dc42c936b4bc2612c20c668f94b37bb5163cc

            SHA256

            c54c9db30df0d4fc34dcb8fece51fe3089d38283665cdd5af2c4846fa26f8e26

            SHA512

            a04afae9d0a2143f4ea5d1754fb1b162571275af935fda205d327765c1181d235a13d76bd204b2517d0a100c58956bd47880f8aad1d8da1b9bc5c8691e80a92c

          • \Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe

            Filesize

            361KB

            MD5

            9e519a78d2ee0e4fa641187866bc9703

            SHA1

            549dc42c936b4bc2612c20c668f94b37bb5163cc

            SHA256

            c54c9db30df0d4fc34dcb8fece51fe3089d38283665cdd5af2c4846fa26f8e26

            SHA512

            a04afae9d0a2143f4ea5d1754fb1b162571275af935fda205d327765c1181d235a13d76bd204b2517d0a100c58956bd47880f8aad1d8da1b9bc5c8691e80a92c

          • \Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe

            Filesize

            361KB

            MD5

            9e519a78d2ee0e4fa641187866bc9703

            SHA1

            549dc42c936b4bc2612c20c668f94b37bb5163cc

            SHA256

            c54c9db30df0d4fc34dcb8fece51fe3089d38283665cdd5af2c4846fa26f8e26

            SHA512

            a04afae9d0a2143f4ea5d1754fb1b162571275af935fda205d327765c1181d235a13d76bd204b2517d0a100c58956bd47880f8aad1d8da1b9bc5c8691e80a92c

          • memory/1364-25-0x0000000006FA0000-0x000000000711B000-memory.dmp

            Filesize

            1.5MB

          • memory/1364-35-0x000007FEF57D0000-0x000007FEF5913000-memory.dmp

            Filesize

            1.3MB

          • memory/1364-30-0x0000000007210000-0x0000000007337000-memory.dmp

            Filesize

            1.2MB

          • memory/1364-15-0x0000000002BB0000-0x0000000002CB0000-memory.dmp

            Filesize

            1024KB

          • memory/1364-32-0x0000000007210000-0x0000000007337000-memory.dmp

            Filesize

            1.2MB

          • memory/1364-29-0x0000000007210000-0x0000000007337000-memory.dmp

            Filesize

            1.2MB

          • memory/1364-17-0x0000000006FA0000-0x000000000711B000-memory.dmp

            Filesize

            1.5MB

          • memory/1364-38-0x000007FEF57D0000-0x000007FEF5913000-memory.dmp

            Filesize

            1.3MB

          • memory/1364-36-0x000007FE86530000-0x000007FE8653A000-memory.dmp

            Filesize

            40KB

          • memory/2044-6-0x00000000001E0000-0x00000000001E2000-memory.dmp

            Filesize

            8KB

          • memory/2636-10-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2636-16-0x00000000002C0000-0x00000000002D4000-memory.dmp

            Filesize

            80KB

          • memory/2636-14-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2636-12-0x0000000000850000-0x0000000000B53000-memory.dmp

            Filesize

            3.0MB

          • memory/2736-22-0x00000000000C0000-0x00000000000EF000-memory.dmp

            Filesize

            188KB

          • memory/2736-27-0x0000000001D40000-0x0000000001DD3000-memory.dmp

            Filesize

            588KB

          • memory/2736-24-0x00000000000C0000-0x00000000000EF000-memory.dmp

            Filesize

            188KB

          • memory/2736-23-0x0000000002010000-0x0000000002313000-memory.dmp

            Filesize

            3.0MB

          • memory/2736-21-0x00000000001D0000-0x00000000001D7000-memory.dmp

            Filesize

            28KB

          • memory/2736-19-0x00000000001D0000-0x00000000001D7000-memory.dmp

            Filesize

            28KB