Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    07-05-2024 19:31

General

  • Target

    103efdb01e1889ae221d336ce2466a80_NEIKI.exe

  • Size

    739KB

  • MD5

    103efdb01e1889ae221d336ce2466a80

  • SHA1

    535a484cc754a4227cba6791be4c4692e334b98e

  • SHA256

    78859999a84ee7e749de4ae398a73af634288c84225daaf740838ec821f7f12f

  • SHA512

    b68fc6348a36a6e85575917f528819e1105ba364f48f2f848817633ff9f274d0ae0aeeb19ba378d5fe34de0ac6f8c92506e4494bef5004ad58df374db231ca3d

  • SSDEEP

    12288:LxN50quGgIVlMtlbbYIyc1iB5uXjXOGaOEFeZ1TUDI3CfCku96GGemz5tlPDK4:LxN5juYDMtlbEIn1iBMTOGV4O1TV3Cqf

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\103efdb01e1889ae221d336ce2466a80_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\103efdb01e1889ae221d336ce2466a80_NEIKI.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Users\Admin\AppData\Local\Temp\103efdb01e1889ae221d336ce2466a80_NEIKI.exe
      "C:\Users\Admin\AppData\Local\Temp\103efdb01e1889ae221d336ce2466a80_NEIKI.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2244-6-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2244-8-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2244-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2244-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2244-15-0x0000000000840000-0x0000000000B43000-memory.dmp

    Filesize

    3.0MB

  • memory/2424-0-0x00000000741BE000-0x00000000741BF000-memory.dmp

    Filesize

    4KB

  • memory/2424-1-0x0000000000BB0000-0x0000000000C6E000-memory.dmp

    Filesize

    760KB

  • memory/2424-2-0x00000000741B0000-0x000000007489E000-memory.dmp

    Filesize

    6.9MB

  • memory/2424-3-0x00000000003B0000-0x00000000003C6000-memory.dmp

    Filesize

    88KB

  • memory/2424-4-0x0000000000580000-0x0000000000596000-memory.dmp

    Filesize

    88KB

  • memory/2424-5-0x0000000004CF0000-0x0000000004D66000-memory.dmp

    Filesize

    472KB

  • memory/2424-14-0x00000000741B0000-0x000000007489E000-memory.dmp

    Filesize

    6.9MB