Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2023, 17:21

General

  • Target

    NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe

  • Size

    589KB

  • MD5

    c93182a4cf39e6a36f143371cd3cdac1

  • SHA1

    9388f926f519112cad9bc5d58cb132a50acaf3ae

  • SHA256

    760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139

  • SHA512

    9c8923b71c19dc7ec47a3df430d094fd6b55d727be51e7d68a1c594753c1ebe1e51134a8f21db12e02e2293325b0ba8b5298838762ed80320da8277a9403e0de

  • SSDEEP

    12288:L8zS55mFzaz4QP5y8YToG7a77FI0LcD8VrdYdQnoc2Z6uj0:Lf55qG4+5y8COm0LYW5YdQnWZ6G

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ls02

Decoy

vocabularybot.com

invisalignsmilesolutions.xyz

sleepdisorderinsomnia.com

bern.beauty

ahazmcdris.top

21874960sie8ca1.store

yeitced.xyz

biggerpictureventures.com

alduhagroup.com

itsolutions.biz

0oq6y.com

wildpolis.com

mariobet469.com

brynnwpods.com

tastywin.com

cou2m1.com

newaitrucks.com

puremeans.studio

mitienda-la.com

jujuresorthotel.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"
      2⤵
        PID:2852
      • C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe
        "C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"
        2⤵
          PID:2712
        • C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe
          "C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2840

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1576-6-0x00000000003F0000-0x0000000000400000-memory.dmp

              Filesize

              64KB

            • memory/1576-15-0x0000000074210000-0x00000000748FE000-memory.dmp

              Filesize

              6.9MB

            • memory/1576-2-0x0000000000410000-0x0000000000450000-memory.dmp

              Filesize

              256KB

            • memory/1576-3-0x0000000000490000-0x00000000004A8000-memory.dmp

              Filesize

              96KB

            • memory/1576-4-0x0000000074210000-0x00000000748FE000-memory.dmp

              Filesize

              6.9MB

            • memory/1576-5-0x0000000000410000-0x0000000000450000-memory.dmp

              Filesize

              256KB

            • memory/1576-7-0x0000000004E10000-0x0000000004E7E000-memory.dmp

              Filesize

              440KB

            • memory/1576-1-0x0000000074210000-0x00000000748FE000-memory.dmp

              Filesize

              6.9MB

            • memory/1576-0-0x00000000000A0000-0x0000000000138000-memory.dmp

              Filesize

              608KB

            • memory/2840-10-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2840-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2840-14-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2840-8-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2840-16-0x0000000000810000-0x0000000000B13000-memory.dmp

              Filesize

              3.0MB