Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04/01/2024, 20:30
General
-
Target
f90db97e56f2eb46d2e55a0cd7674997bbc2d644f6370b477fd04edfca7b9cdd.exe
-
Size
446KB
-
MD5
e10c2c5de1c6b8be9f4d6814930fd018
-
SHA1
9305c3478e82b8e05395c6010737b2ca50e9a026
-
SHA256
f90db97e56f2eb46d2e55a0cd7674997bbc2d644f6370b477fd04edfca7b9cdd
-
SHA512
f8c83a346b2e29d8915ba00fef8eaf7d15dfebaffea2ad5e9863bcac3414a224926b627c2371644e0a48ff602aede5ad4b21f2d1513e95a306a6fe2997011040
-
SSDEEP
12288:YvL8c8ld2qLqxhHe6wQfDxRvIxVvJRjs:e85OqLAHLwQbxtcVvJC
Malware Config
Extracted
formbook
4.1
rhtn
ctwlabs.com
zaimjefhi.online
janetsboutiquestore.com
srello.com
dk1380.com
thuphangahhome.com
usahealthcarenetwork.com
ostbet.com
artbacus.com
kuaitaobao.net
aeinnamehranandegi.com
glassesbestselect.com
drain-pipe-cleaning-47086.bond
beyondhorsemanship.com
cottonfuturesbook.com
fairfieldcountyb.com
worldtoronto.com
onairnepal.com
kongmad.com
host-u.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f90db97e56f2eb46d2e55a0cd7674997bbc2d644f6370b477fd04edfca7b9cdd.exe"C:\Users\Admin\AppData\Local\Temp\f90db97e56f2eb46d2e55a0cd7674997bbc2d644f6370b477fd04edfca7b9cdd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SYSWOW64\calc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\calc.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
472KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
152KB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
28KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
124KB
-
Filesize
180KB
-
Filesize
52KB
-
Filesize
180KB
-
Filesize
780KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
104KB
-
Filesize
272KB
-
Filesize
192KB
-
Filesize
384KB
-
Filesize
128KB
-
Filesize
2.8MB
-
Filesize
120KB
-
Filesize
496KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
624KB
-
Filesize
496KB
-
Filesize
120KB
-
Filesize
2.8MB
-
Filesize
128KB
-
Filesize
384KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
192KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
272KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
104KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
112KB
-
Filesize
76KB
-
Filesize
236KB
-
Filesize
1.0MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
128KB
-
Filesize
548KB
-
Filesize
224KB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
1.5MB