Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02-04-2024 10:15

General

  • Target

    3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a.exe

  • Size

    652KB

  • MD5

    26a38af05a6bdd23f047eb65fee67251

  • SHA1

    61633e621f7d7cdcca5936b27a18cfe7e5169aae

  • SHA256

    3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a

  • SHA512

    7d852f05e4377b77691c3c7517609b6bd12c96d0c5dfe0bb330974ff891731529c12da9a7d52ea0f4e526fd35ce35237bfe40d2099afc12f59e58f95157e16b9

  • SSDEEP

    12288:JCTYHa5WHBh2Izs6vHhIlvyuq7it546mz2p9:QTYNHU6vHKlvU7ij46mKp

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy07

Decoy

katemclaughl.in

worthyofficial.com

digitopia.click

ledmee.com

siwaasnz.life

ba-y.com

specifiedbuild.com

abandoned-houses-pt-0.bond

yesxoit.xyz

onlinemehrgeld.com

gosysamergoods.com

speakdontell.com

brokenequipmentsolutions.online

gruppofebi.cloud

adilosk.shop

supplierpartnerportal.com

wizov.dev

fast-homeinsurance.com

j88.vote

onamaevn.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a.exe
    "C:\Users\Admin\AppData\Local\Temp\3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wIJCOfiF.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2556
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wIJCOfiF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp737B.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2720
    • C:\Users\Admin\AppData\Local\Temp\3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a.exe
      "C:\Users\Admin\AppData\Local\Temp\3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a.exe"
      2⤵
        PID:2696
      • C:\Users\Admin\AppData\Local\Temp\3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a.exe
        "C:\Users\Admin\AppData\Local\Temp\3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2688

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp737B.tmp

      Filesize

      1KB

      MD5

      4f8383685b9f14299ec2482b39874087

      SHA1

      fe1f3edf5665aa0396c5c2fe99bcde209835e37c

      SHA256

      bea6bda4355cef44759d7767e16eec0c5e1b6340050d07b49e57e26954761ea3

      SHA512

      82fcfce681837c5f0d09269758aed10f35c4c5b2f6db240fcda1480e46400280a4035bf8eda9d407ccada59a21cd086c11b685d8391bfd85b1b4a8d842f2149b

    • memory/2308-3-0x00000000003B0000-0x00000000003C2000-memory.dmp

      Filesize

      72KB

    • memory/2308-2-0x0000000004960000-0x00000000049A0000-memory.dmp

      Filesize

      256KB

    • memory/2308-4-0x00000000003D0000-0x00000000003DC000-memory.dmp

      Filesize

      48KB

    • memory/2308-5-0x00000000043C0000-0x0000000004436000-memory.dmp

      Filesize

      472KB

    • memory/2308-1-0x0000000000AC0000-0x0000000000B68000-memory.dmp

      Filesize

      672KB

    • memory/2308-0-0x00000000741A0000-0x000000007488E000-memory.dmp

      Filesize

      6.9MB

    • memory/2308-18-0x00000000741A0000-0x000000007488E000-memory.dmp

      Filesize

      6.9MB

    • memory/2556-20-0x000000006E5F0000-0x000000006EB9B000-memory.dmp

      Filesize

      5.7MB

    • memory/2556-24-0x000000006E5F0000-0x000000006EB9B000-memory.dmp

      Filesize

      5.7MB

    • memory/2556-23-0x00000000025B0000-0x00000000025F0000-memory.dmp

      Filesize

      256KB

    • memory/2556-21-0x000000006E5F0000-0x000000006EB9B000-memory.dmp

      Filesize

      5.7MB

    • memory/2556-22-0x00000000025B0000-0x00000000025F0000-memory.dmp

      Filesize

      256KB

    • memory/2688-12-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2688-19-0x0000000000B70000-0x0000000000E73000-memory.dmp

      Filesize

      3.0MB

    • memory/2688-15-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2688-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2688-11-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB