Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 17:21

General

  • Target

    NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe

  • Size

    589KB

  • MD5

    c93182a4cf39e6a36f143371cd3cdac1

  • SHA1

    9388f926f519112cad9bc5d58cb132a50acaf3ae

  • SHA256

    760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139

  • SHA512

    9c8923b71c19dc7ec47a3df430d094fd6b55d727be51e7d68a1c594753c1ebe1e51134a8f21db12e02e2293325b0ba8b5298838762ed80320da8277a9403e0de

  • SSDEEP

    12288:L8zS55mFzaz4QP5y8YToG7a77FI0LcD8VrdYdQnoc2Z6uj0:Lf55qG4+5y8COm0LYW5YdQnWZ6G

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ls02

Decoy

vocabularybot.com

invisalignsmilesolutions.xyz

sleepdisorderinsomnia.com

bern.beauty

ahazmcdris.top

21874960sie8ca1.store

yeitced.xyz

biggerpictureventures.com

alduhagroup.com

itsolutions.biz

0oq6y.com

wildpolis.com

mariobet469.com

brynnwpods.com

tastywin.com

cou2m1.com

newaitrucks.com

puremeans.studio

mitienda-la.com

jujuresorthotel.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"
      2⤵
        PID:4648
      • C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe
        "C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"
        2⤵
          PID:4640
        • C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe
          "C:\Users\Admin\AppData\Local\Temp\NEAS.760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139exe_JC.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2088

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2088-12-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2088-15-0x0000000001510000-0x000000000185A000-memory.dmp

              Filesize

              3.3MB

            • memory/5100-6-0x0000000005D30000-0x0000000005DCC000-memory.dmp

              Filesize

              624KB

            • memory/5100-3-0x0000000005A10000-0x0000000005AA2000-memory.dmp

              Filesize

              584KB

            • memory/5100-4-0x0000000005BE0000-0x0000000005BF0000-memory.dmp

              Filesize

              64KB

            • memory/5100-5-0x0000000005BB0000-0x0000000005BBA000-memory.dmp

              Filesize

              40KB

            • memory/5100-0-0x0000000074F40000-0x00000000756F0000-memory.dmp

              Filesize

              7.7MB

            • memory/5100-7-0x0000000007430000-0x0000000007448000-memory.dmp

              Filesize

              96KB

            • memory/5100-8-0x0000000074F40000-0x00000000756F0000-memory.dmp

              Filesize

              7.7MB

            • memory/5100-9-0x0000000005BE0000-0x0000000005BF0000-memory.dmp

              Filesize

              64KB

            • memory/5100-10-0x0000000006FB0000-0x0000000006FC0000-memory.dmp

              Filesize

              64KB

            • memory/5100-11-0x0000000007620000-0x000000000768E000-memory.dmp

              Filesize

              440KB

            • memory/5100-2-0x0000000005EE0000-0x0000000006484000-memory.dmp

              Filesize

              5.6MB

            • memory/5100-14-0x0000000074F40000-0x00000000756F0000-memory.dmp

              Filesize

              7.7MB

            • memory/5100-1-0x0000000000F90000-0x0000000001028000-memory.dmp

              Filesize

              608KB