Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 08:59

General

  • Target

    v0hRSGca3D2Z7cW.exe

  • Size

    779KB

  • MD5

    79869ac2557f532c7db50785f59f8057

  • SHA1

    4458bc01d37a3a3feb24b8da5b9f8190356c59d8

  • SHA256

    6465b2c5702a723c7229e33fdf38676e3b0e0049b5b632e2fe6e210713f6a7e7

  • SHA512

    b2079da931d878accc6c2f7f81f07b313689bcbeccb7319a3b1fac7dcf3abfc44406a40d48215bd8d74519bed1d266a3ccb81549b5fe14bd41c4600698647fea

  • SSDEEP

    12288:HuqnHvjNIrpf9rN/mc/ChYgp70NtH95FYIqe17df6dFFHCApvlmJg0kR:H7PjKr5BNDUYgl8tdDY1qBf6d/HCApdr

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

be03

Decoy

458q14v4ams2.com

priceoctopus.com

betinplay.xyz

bcnd.xyz

1510soliveavenue.com

mcdpropertypros.com

reddcrownexpress.com

rewardlabs.shop

burenbrand.com

revand.io

tractionendurancecoaching.com

jotaerreshopp.com

shopboyg.com

dakor.shop

groundswellmag.life

nehagadodia.com

dancarellibizbroker.com

meconline.co

ttmq.cc

thegoldenyouph.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3432
    • C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe
      "C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe
        "C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1416
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"
        3⤵
          PID:2908

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1416-10-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1416-15-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1416-16-0x0000000001000000-0x0000000001014000-memory.dmp
      Filesize

      80KB

    • memory/1416-13-0x0000000001070000-0x00000000013BA000-memory.dmp
      Filesize

      3.3MB

    • memory/3068-20-0x0000000000120000-0x000000000014F000-memory.dmp
      Filesize

      188KB

    • memory/3068-18-0x0000000000370000-0x000000000037C000-memory.dmp
      Filesize

      48KB

    • memory/3068-24-0x0000000002180000-0x0000000002213000-memory.dmp
      Filesize

      588KB

    • memory/3068-22-0x0000000000120000-0x000000000014F000-memory.dmp
      Filesize

      188KB

    • memory/3068-21-0x0000000002300000-0x000000000264A000-memory.dmp
      Filesize

      3.3MB

    • memory/3068-19-0x0000000000370000-0x000000000037C000-memory.dmp
      Filesize

      48KB

    • memory/3432-17-0x0000000008E80000-0x0000000008FF2000-memory.dmp
      Filesize

      1.4MB

    • memory/3432-25-0x0000000008E80000-0x0000000008FF2000-memory.dmp
      Filesize

      1.4MB

    • memory/3432-35-0x0000000007B80000-0x0000000007CC2000-memory.dmp
      Filesize

      1.3MB

    • memory/3432-32-0x0000000007B80000-0x0000000007CC2000-memory.dmp
      Filesize

      1.3MB

    • memory/3432-31-0x0000000007B80000-0x0000000007CC2000-memory.dmp
      Filesize

      1.3MB

    • memory/4180-9-0x000000000BE40000-0x000000000BEDC000-memory.dmp
      Filesize

      624KB

    • memory/4180-4-0x0000000005110000-0x0000000005120000-memory.dmp
      Filesize

      64KB

    • memory/4180-12-0x0000000074AB0000-0x0000000075260000-memory.dmp
      Filesize

      7.7MB

    • memory/4180-1-0x0000000074AB0000-0x0000000075260000-memory.dmp
      Filesize

      7.7MB

    • memory/4180-8-0x0000000008D30000-0x0000000008DA6000-memory.dmp
      Filesize

      472KB

    • memory/4180-7-0x00000000052F0000-0x0000000005304000-memory.dmp
      Filesize

      80KB

    • memory/4180-6-0x0000000005330000-0x0000000005350000-memory.dmp
      Filesize

      128KB

    • memory/4180-5-0x0000000004F40000-0x0000000004F4A000-memory.dmp
      Filesize

      40KB

    • memory/4180-0-0x00000000003E0000-0x00000000004A4000-memory.dmp
      Filesize

      784KB

    • memory/4180-2-0x0000000005360000-0x0000000005904000-memory.dmp
      Filesize

      5.6MB

    • memory/4180-3-0x0000000004E90000-0x0000000004F22000-memory.dmp
      Filesize

      584KB