Analysis

  • max time kernel
    158s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 16:47

General

  • Target

    NEAS.354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579exe_JC.exe

  • Size

    426KB

  • MD5

    df247bbfaf91dbe0da4d79a04cfb5ca3

  • SHA1

    0d29cbfa4b746e71c680bbd56a6c51964fd9b1fa

  • SHA256

    354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579

  • SHA512

    ea413b9f389b9bb2bd8eaca5c3917a656840df5d48c5fb5478d9b453412fe941229cae535df587a66996acb9b96a4c692491ebe65a106d35eb0b757d6412286b

  • SSDEEP

    6144:zfL+oqgoT3oPrD68F2PD44p8Ls1k7n82iKGI3TmBp6CbspK7M2jtsftCq9CPbz:zfLCT21oy82PGIC/Bb8K7MNCB/

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sy22

Decoy

vinteligencia.com

displayfridges.fun

completetip.com

giallozafferrano.com

jizihao1.com

mysticheightstrail.com

fourseasonslb.com

kjnala.shop

mosiacwall.com

vandistreet.com

gracefullytouchedartistry.com

hbiwhwr.shop

mfmz.net

hrmbrillianz.com

funwarsztat.com

polewithcandy.com

ourrajasthan.com

wilhouettteamerica.com

johnnystintshop.com

asgnelwin.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Users\Admin\AppData\Local\Temp\NEAS.354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579exe_JC.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe
        "C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1872
        • C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe
          "C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2872
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:1664
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\SysWOW64\wscript.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe"
          3⤵
            PID:228

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\iomgmdsgtbq.p

              Filesize

              205KB

              MD5

              60d116c175aabe2c06bdd949a101127c

              SHA1

              63bb316383b4706d43f7882ee545031c4cac2505

              SHA256

              ee52d5afe32c612681d16c9bfee4cdb923ee5e54b84196b7b5ecc0aa4ad1df76

              SHA512

              d90f9148243101db90de1945854a9dd1e6aa6fd59ff0ccb1ff0053f7f91b8b40176a7d5401e63a5600474bfc8749733ff55cc76fa2094a697eb14726241a2fe9

            • C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe

              Filesize

              361KB

              MD5

              9e519a78d2ee0e4fa641187866bc9703

              SHA1

              549dc42c936b4bc2612c20c668f94b37bb5163cc

              SHA256

              c54c9db30df0d4fc34dcb8fece51fe3089d38283665cdd5af2c4846fa26f8e26

              SHA512

              a04afae9d0a2143f4ea5d1754fb1b162571275af935fda205d327765c1181d235a13d76bd204b2517d0a100c58956bd47880f8aad1d8da1b9bc5c8691e80a92c

            • C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe

              Filesize

              361KB

              MD5

              9e519a78d2ee0e4fa641187866bc9703

              SHA1

              549dc42c936b4bc2612c20c668f94b37bb5163cc

              SHA256

              c54c9db30df0d4fc34dcb8fece51fe3089d38283665cdd5af2c4846fa26f8e26

              SHA512

              a04afae9d0a2143f4ea5d1754fb1b162571275af935fda205d327765c1181d235a13d76bd204b2517d0a100c58956bd47880f8aad1d8da1b9bc5c8691e80a92c

            • C:\Users\Admin\AppData\Local\Temp\ohtfjmxqk.exe

              Filesize

              361KB

              MD5

              9e519a78d2ee0e4fa641187866bc9703

              SHA1

              549dc42c936b4bc2612c20c668f94b37bb5163cc

              SHA256

              c54c9db30df0d4fc34dcb8fece51fe3089d38283665cdd5af2c4846fa26f8e26

              SHA512

              a04afae9d0a2143f4ea5d1754fb1b162571275af935fda205d327765c1181d235a13d76bd204b2517d0a100c58956bd47880f8aad1d8da1b9bc5c8691e80a92c

            • memory/1872-5-0x00000000021C0000-0x00000000021C2000-memory.dmp

              Filesize

              8KB

            • memory/2872-9-0x0000000000B00000-0x0000000000E4A000-memory.dmp

              Filesize

              3.3MB

            • memory/2872-11-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2872-12-0x00000000009D0000-0x00000000009E4000-memory.dmp

              Filesize

              80KB

            • memory/2872-7-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/3328-20-0x0000000002B40000-0x0000000002C2E000-memory.dmp

              Filesize

              952KB

            • memory/3328-13-0x0000000002B40000-0x0000000002C2E000-memory.dmp

              Filesize

              952KB

            • memory/3328-27-0x0000000008820000-0x0000000008980000-memory.dmp

              Filesize

              1.4MB

            • memory/3328-25-0x0000000008820000-0x0000000008980000-memory.dmp

              Filesize

              1.4MB

            • memory/3328-24-0x0000000008820000-0x0000000008980000-memory.dmp

              Filesize

              1.4MB

            • memory/5048-16-0x00000000002A0000-0x00000000002C7000-memory.dmp

              Filesize

              156KB

            • memory/5048-21-0x0000000000370000-0x000000000039F000-memory.dmp

              Filesize

              188KB

            • memory/5048-23-0x00000000025E0000-0x0000000002673000-memory.dmp

              Filesize

              588KB

            • memory/5048-19-0x00000000027A0000-0x0000000002AEA000-memory.dmp

              Filesize

              3.3MB

            • memory/5048-18-0x0000000000370000-0x000000000039F000-memory.dmp

              Filesize

              188KB

            • memory/5048-17-0x00000000002A0000-0x00000000002C7000-memory.dmp

              Filesize

              156KB