Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2024 16:37

General

  • Target

    Confirmation de paiement.exe

  • Size

    400KB

  • MD5

    b7056d5765c2af266f183f7f255ea98c

  • SHA1

    2259c9f9e701cedfdfefd19473495261bf2f8f01

  • SHA256

    8683941dc107f93a4fcd68ef852d59795a3c790bccf91680b1729f2fb8ed3cd7

  • SHA512

    5d9aa582ab237655b4b56cb2e58829d4c4a9b34a795a278798a9d1149003f6822b8ddfc0a37da8cfac59f8528381c9d27f29346e243f5b0bc777d23bc30c4e36

  • SSDEEP

    6144:cwI5Lbz5FmDHUeBN+kNUvoxF6FoVrm1YnIJbqxwFAMRyxUG+w/r1FOOI:25LX5FmD0elRx0nYxwFAMRYUG+w/qO

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

upio

Decoy

thecantonmentcookhouse.com

1for1ecomask.com

thatvintagehome.com

momentbymomentmindfulness.com

denxmedia.com

arc-corner.com

siddharthmakharia.com

meiluk.com

toughu.com

hotelwisatabaru.com

ibluebelt3dbuy.com

bestfootwearhk.com

wbjobalerts.com

radiancenurestoringcleanse.com

xintianlongyeya.com

docauphuhau.com

liberty-furniture.com

ranchhousepizzaonline.com

bednhomes.com

kollakids.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3520
    • C:\Users\Admin\AppData\Local\Temp\Confirmation de paiement.exe
      "C:\Users\Admin\AppData\Local\Temp\Confirmation de paiement.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3160
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pIHJhbCBS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF78F.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:4920
      • C:\Users\Admin\AppData\Local\Temp\Confirmation de paiement.exe
        "C:\Users\Admin\AppData\Local\Temp\Confirmation de paiement.exe"
        3⤵
          PID:1564
        • C:\Users\Admin\AppData\Local\Temp\Confirmation de paiement.exe
          "C:\Users\Admin\AppData\Local\Temp\Confirmation de paiement.exe"
          3⤵
            PID:3308
          • C:\Users\Admin\AppData\Local\Temp\Confirmation de paiement.exe
            "C:\Users\Admin\AppData\Local\Temp\Confirmation de paiement.exe"
            3⤵
              PID:1960
            • C:\Users\Admin\AppData\Local\Temp\Confirmation de paiement.exe
              "C:\Users\Admin\AppData\Local\Temp\Confirmation de paiement.exe"
              3⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:732
          • C:\Windows\SysWOW64\systray.exe
            "C:\Windows\SysWOW64\systray.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4624
            • C:\Windows\SysWOW64\cmd.exe
              /c del "C:\Users\Admin\AppData\Local\Temp\Confirmation de paiement.exe"
              3⤵
                PID:1004

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/732-16-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/732-22-0x0000000000FE0000-0x0000000000FF4000-memory.dmp

            Filesize

            80KB

          • memory/732-21-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/732-20-0x0000000001370000-0x00000000016BA000-memory.dmp

            Filesize

            3.3MB

          • memory/3160-18-0x0000000075250000-0x0000000075A00000-memory.dmp

            Filesize

            7.7MB

          • memory/3160-1-0x0000000075250000-0x0000000075A00000-memory.dmp

            Filesize

            7.7MB

          • memory/3160-6-0x0000000005910000-0x000000000591E000-memory.dmp

            Filesize

            56KB

          • memory/3160-7-0x0000000075250000-0x0000000075A00000-memory.dmp

            Filesize

            7.7MB

          • memory/3160-8-0x00000000055E0000-0x00000000055F0000-memory.dmp

            Filesize

            64KB

          • memory/3160-9-0x0000000008280000-0x000000000831C000-memory.dmp

            Filesize

            624KB

          • memory/3160-10-0x00000000083C0000-0x0000000008418000-memory.dmp

            Filesize

            352KB

          • memory/3160-4-0x00000000055E0000-0x00000000055F0000-memory.dmp

            Filesize

            64KB

          • memory/3160-0-0x0000000000910000-0x000000000097A000-memory.dmp

            Filesize

            424KB

          • memory/3160-3-0x0000000005410000-0x00000000054A2000-memory.dmp

            Filesize

            584KB

          • memory/3160-2-0x0000000005920000-0x0000000005EC4000-memory.dmp

            Filesize

            5.6MB

          • memory/3160-5-0x0000000005380000-0x000000000538A000-memory.dmp

            Filesize

            40KB

          • memory/3520-23-0x00000000033C0000-0x00000000034B9000-memory.dmp

            Filesize

            996KB

          • memory/3520-33-0x0000000009090000-0x0000000009213000-memory.dmp

            Filesize

            1.5MB

          • memory/3520-34-0x0000000009090000-0x0000000009213000-memory.dmp

            Filesize

            1.5MB

          • memory/3520-37-0x0000000009090000-0x0000000009213000-memory.dmp

            Filesize

            1.5MB

          • memory/4624-24-0x00000000008D0000-0x00000000008D6000-memory.dmp

            Filesize

            24KB

          • memory/4624-25-0x00000000008D0000-0x00000000008D6000-memory.dmp

            Filesize

            24KB

          • memory/4624-26-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

            Filesize

            184KB

          • memory/4624-27-0x0000000002D70000-0x00000000030BA000-memory.dmp

            Filesize

            3.3MB

          • memory/4624-28-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

            Filesize

            184KB

          • memory/4624-30-0x0000000002C60000-0x0000000002CF3000-memory.dmp

            Filesize

            588KB