Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-03-2024 02:41

General

  • Target

    9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784.exe

  • Size

    590KB

  • MD5

    2f9e1385a9c419ad70bb121e4250ae0a

  • SHA1

    ee2018b7427e3eccd78683018864043a72d841a9

  • SHA256

    9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784

  • SHA512

    9c7a9d86a29729b1189a027e11c40175928c2c76355678ebaa06a08b42a8b0d6c0e6ba6237d61aa81a8a80e8b9d52b22c877f45dd74a233c720fee10e6419917

  • SSDEEP

    12288:IS4CMwNNFJyvdgH7RPTwerlTuzRjynjSGqaJt2m8:IMFggH7RbweRTuzJsjSGqaJsm8

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

o22d

Decoy

stillsfengservices.com

protectagainstcrime.com

winiboya.com

mindbeforemusic.com

giyelz1i5.sbs

coin8899.com

coolgirls.club

ssdcf1416aasx.world

heir.solutions

soulmatchup.xyz

ingenetpy.com

knkvdqt5g.sbs

vireoremedy.com

leopolis.rent

apartment-for-rent-314.space

theenlightenedmotherhood.com

zidao.cloud

oi7982jbacdbfssagroup.monster

anandasnacks.com

start.beer

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Detects executables packed with SmartAssembly 1 IoCs
  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784.exe
    "C:\Users\Admin\AppData\Local\Temp\9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784.exe
      "C:\Users\Admin\AppData\Local\Temp\9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3040-6-0x0000000004F90000-0x0000000004FA2000-memory.dmp
    Filesize

    72KB

  • memory/3040-1-0x0000000074DA0000-0x0000000075550000-memory.dmp
    Filesize

    7.7MB

  • memory/3040-2-0x0000000004FE0000-0x0000000005584000-memory.dmp
    Filesize

    5.6MB

  • memory/3040-3-0x0000000004A30000-0x0000000004AC2000-memory.dmp
    Filesize

    584KB

  • memory/3040-4-0x00000000049D0000-0x00000000049E0000-memory.dmp
    Filesize

    64KB

  • memory/3040-5-0x0000000004A00000-0x0000000004A0A000-memory.dmp
    Filesize

    40KB

  • memory/3040-0-0x00000000000A0000-0x000000000013A000-memory.dmp
    Filesize

    616KB

  • memory/3040-7-0x0000000004FB0000-0x0000000004FBC000-memory.dmp
    Filesize

    48KB

  • memory/3040-8-0x00000000062B0000-0x0000000006326000-memory.dmp
    Filesize

    472KB

  • memory/3040-9-0x0000000008900000-0x000000000899C000-memory.dmp
    Filesize

    624KB

  • memory/3040-12-0x0000000074DA0000-0x0000000075550000-memory.dmp
    Filesize

    7.7MB

  • memory/3968-10-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/3968-13-0x0000000001450000-0x000000000179A000-memory.dmp
    Filesize

    3.3MB