Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08-05-2024 02:19

General

  • Target

    Doc53436.exe

  • Size

    592KB

  • MD5

    0a97fae0860363de54832184dfd95952

  • SHA1

    b7169157062c6e27c3b093e70e7e88fe72a35d36

  • SHA256

    9f7c3f92efbdaec249b532ceb5f3d3e310c7142b7d327fb6f73fc6899781e59d

  • SHA512

    2900967160a6b3e7749281700031bd4f3869391ed52a35218a51fd926fce21076376458fd20a193b8672e10b803e4b821b1939708c9670e1588bfe259168ff6f

  • SSDEEP

    6144:175yLTtJ12bxs/2Mbavm/cSNTgSRgR0QdSdfslVOU6an295l5fDTWSnLGHIVifW6:1iT8tM0mUeTaGQdnUjU+TfvWSgfW4p

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

h9s

Decoy

domidu.com

twelvei.com

palchecker.com

onariart.com

thescarfhut.com

alimotorsandbikes.com

brianneamira.com

tabwindow.com

babybabymom.com

howtostartanllcbusiness.com

cjaiou.com

californiamentoring.com

21millionbits.com

metgranite.com

ujphy.com

8eves.com

backstorysongs.com

www835234.com

szshijia.com

alquimarket.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Adds policy Run key to start application 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
        "C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2456
        • C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
          "C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2536
          • C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
            "C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"
            4⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1564
            • C:\Windows\SysWOW64\chkdsk.exe
              "C:\Windows\SysWOW64\chkdsk.exe"
              5⤵
              • Adds policy Run key to start application
              • Suspicious use of SetThreadContext
              • Drops file in Program Files directory
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2836
              • C:\Windows\SysWOW64\cmd.exe
                /c del "C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"
                6⤵
                • Deletes itself
                PID:1324

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\win.ini

      Filesize

      509B

      MD5

      d2a2412bddba16d60ec63bd9550d933f

      SHA1

      deb3d3bdc9055f0b4909b31d3048446848fae0e1

      SHA256

      79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

      SHA512

      8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

    • memory/1204-19-0x0000000006440000-0x0000000006505000-memory.dmp

      Filesize

      788KB

    • memory/1204-15-0x0000000002D80000-0x0000000002E80000-memory.dmp

      Filesize

      1024KB

    • memory/1204-27-0x0000000006510000-0x00000000065D7000-memory.dmp

      Filesize

      796KB

    • memory/1204-25-0x0000000004BC0000-0x0000000004C9B000-memory.dmp

      Filesize

      876KB

    • memory/1204-16-0x0000000004BC0000-0x0000000004C9B000-memory.dmp

      Filesize

      876KB

    • memory/1564-13-0x0000000077920000-0x0000000077AC9000-memory.dmp

      Filesize

      1.7MB

    • memory/1564-10-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1564-17-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1564-18-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/2456-5-0x0000000077920000-0x0000000077AC9000-memory.dmp

      Filesize

      1.7MB

    • memory/2456-3-0x00000000003B0000-0x00000000003B6000-memory.dmp

      Filesize

      24KB

    • memory/2456-4-0x0000000077921000-0x0000000077A22000-memory.dmp

      Filesize

      1.0MB

    • memory/2536-11-0x0000000077B10000-0x0000000077BE6000-memory.dmp

      Filesize

      856KB

    • memory/2536-12-0x00000000002A0000-0x00000000002A6000-memory.dmp

      Filesize

      24KB

    • memory/2836-23-0x0000000000770000-0x0000000000777000-memory.dmp

      Filesize

      28KB

    • memory/2836-24-0x0000000000770000-0x0000000000777000-memory.dmp

      Filesize

      28KB