Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2023, 19:38

General

  • Target

    NEAS.fd8ec7e66dab730de6d7a96168974b95f2e9ba43c0c05b5fac55b3abc8a52d73exe_JC.exe

  • Size

    635KB

  • MD5

    338813a058a8a13c04afe5a9b7db531b

  • SHA1

    5854ef67aad79a7d9cbe7111d334dd062ca6e09c

  • SHA256

    fd8ec7e66dab730de6d7a96168974b95f2e9ba43c0c05b5fac55b3abc8a52d73

  • SHA512

    aedca8aed3ae987138dfd7e77cdda73ee8203bfd8d93490ca411c4b1c66d6cb4b9e73e51e6d96cb458e386dfff9c8c4221c180421341d2ad7b280429fd1c586d

  • SSDEEP

    12288:AT7s92gnd0vY0nnmc2G0oxZTYAx8Te2F5LBRXa8lv1JcTcwn:AT7s99dEY0/0oxZUT3Ha8dLcQg

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ls02

Decoy

vocabularybot.com

invisalignsmilesolutions.xyz

sleepdisorderinsomnia.com

bern.beauty

ahazmcdris.top

21874960sie8ca1.store

yeitced.xyz

biggerpictureventures.com

alduhagroup.com

itsolutions.biz

0oq6y.com

wildpolis.com

mariobet469.com

brynnwpods.com

tastywin.com

cou2m1.com

newaitrucks.com

puremeans.studio

mitienda-la.com

jujuresorthotel.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.fd8ec7e66dab730de6d7a96168974b95f2e9ba43c0c05b5fac55b3abc8a52d73exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.fd8ec7e66dab730de6d7a96168974b95f2e9ba43c0c05b5fac55b3abc8a52d73exe_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Users\Admin\AppData\Local\Temp\NEAS.fd8ec7e66dab730de6d7a96168974b95f2e9ba43c0c05b5fac55b3abc8a52d73exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.fd8ec7e66dab730de6d7a96168974b95f2e9ba43c0c05b5fac55b3abc8a52d73exe_JC.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2844

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2844-8-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2844-16-0x0000000000910000-0x0000000000C13000-memory.dmp

          Filesize

          3.0MB

        • memory/2844-14-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2844-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2844-10-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2888-3-0x0000000000B80000-0x0000000000B98000-memory.dmp

          Filesize

          96KB

        • memory/2888-6-0x0000000000380000-0x0000000000390000-memory.dmp

          Filesize

          64KB

        • memory/2888-7-0x0000000004FD0000-0x000000000503E000-memory.dmp

          Filesize

          440KB

        • memory/2888-5-0x0000000000CA0000-0x0000000000CE0000-memory.dmp

          Filesize

          256KB

        • memory/2888-4-0x0000000074EA0000-0x000000007558E000-memory.dmp

          Filesize

          6.9MB

        • memory/2888-0-0x00000000011D0000-0x0000000001274000-memory.dmp

          Filesize

          656KB

        • memory/2888-2-0x0000000000CA0000-0x0000000000CE0000-memory.dmp

          Filesize

          256KB

        • memory/2888-15-0x0000000074EA0000-0x000000007558E000-memory.dmp

          Filesize

          6.9MB

        • memory/2888-1-0x0000000074EA0000-0x000000007558E000-memory.dmp

          Filesize

          6.9MB