Analysis

  • max time kernel
    140s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 19:31

General

  • Target

    103efdb01e1889ae221d336ce2466a80_NEIKI.exe

  • Size

    739KB

  • MD5

    103efdb01e1889ae221d336ce2466a80

  • SHA1

    535a484cc754a4227cba6791be4c4692e334b98e

  • SHA256

    78859999a84ee7e749de4ae398a73af634288c84225daaf740838ec821f7f12f

  • SHA512

    b68fc6348a36a6e85575917f528819e1105ba364f48f2f848817633ff9f274d0ae0aeeb19ba378d5fe34de0ac6f8c92506e4494bef5004ad58df374db231ca3d

  • SSDEEP

    12288:LxN50quGgIVlMtlbbYIyc1iB5uXjXOGaOEFeZ1TUDI3CfCku96GGemz5tlPDK4:LxN5juYDMtlbEIn1iBMTOGV4O1TV3Cqf

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\103efdb01e1889ae221d336ce2466a80_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\103efdb01e1889ae221d336ce2466a80_NEIKI.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\103efdb01e1889ae221d336ce2466a80_NEIKI.exe
      "C:\Users\Admin\AppData\Local\Temp\103efdb01e1889ae221d336ce2466a80_NEIKI.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2352-10-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2352-14-0x0000000001550000-0x000000000189A000-memory.dmp

    Filesize

    3.3MB

  • memory/2352-13-0x0000000001550000-0x000000000189A000-memory.dmp

    Filesize

    3.3MB

  • memory/3768-6-0x00000000050B0000-0x00000000050C6000-memory.dmp

    Filesize

    88KB

  • memory/3768-4-0x0000000005050000-0x000000000505A000-memory.dmp

    Filesize

    40KB

  • memory/3768-5-0x0000000074DB0000-0x0000000075560000-memory.dmp

    Filesize

    7.7MB

  • memory/3768-0-0x0000000074DBE000-0x0000000074DBF000-memory.dmp

    Filesize

    4KB

  • memory/3768-7-0x0000000005370000-0x0000000005386000-memory.dmp

    Filesize

    88KB

  • memory/3768-8-0x00000000062F0000-0x0000000006366000-memory.dmp

    Filesize

    472KB

  • memory/3768-9-0x0000000008AD0000-0x0000000008B6C000-memory.dmp

    Filesize

    624KB

  • memory/3768-3-0x0000000004EA0000-0x0000000004F32000-memory.dmp

    Filesize

    584KB

  • memory/3768-12-0x0000000074DB0000-0x0000000075560000-memory.dmp

    Filesize

    7.7MB

  • memory/3768-2-0x0000000005390000-0x0000000005934000-memory.dmp

    Filesize

    5.6MB

  • memory/3768-1-0x0000000000410000-0x00000000004CE000-memory.dmp

    Filesize

    760KB