Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 02:19

General

  • Target

    Doc53436.exe

  • Size

    592KB

  • MD5

    0a97fae0860363de54832184dfd95952

  • SHA1

    b7169157062c6e27c3b093e70e7e88fe72a35d36

  • SHA256

    9f7c3f92efbdaec249b532ceb5f3d3e310c7142b7d327fb6f73fc6899781e59d

  • SHA512

    2900967160a6b3e7749281700031bd4f3869391ed52a35218a51fd926fce21076376458fd20a193b8672e10b803e4b821b1939708c9670e1588bfe259168ff6f

  • SSDEEP

    6144:175yLTtJ12bxs/2Mbavm/cSNTgSRgR0QdSdfslVOU6an295l5fDTWSnLGHIVifW6:1iT8tM0mUeTaGQdnUjU+TfvWSgfW4p

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

h9s

Decoy

domidu.com

twelvei.com

palchecker.com

onariart.com

thescarfhut.com

alimotorsandbikes.com

brianneamira.com

tabwindow.com

babybabymom.com

howtostartanllcbusiness.com

cjaiou.com

californiamentoring.com

21millionbits.com

metgranite.com

ujphy.com

8eves.com

backstorysongs.com

www835234.com

szshijia.com

alquimarket.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3476
    • C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
      "C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3784
      • C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
        "C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3856
        • C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
          "C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4212
          • C:\Windows\SysWOW64\explorer.exe
            "C:\Windows\SysWOW64\explorer.exe"
            5⤵
            • Adds policy Run key to start application
            • Suspicious use of SetThreadContext
            • Drops file in Program Files directory
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3324
            • C:\Windows\SysWOW64\cmd.exe
              /c del "C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"
              6⤵
                PID:2708
              • C:\Windows\SysWOW64\cmd.exe
                /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
                6⤵
                  PID:1084

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\DB1

        Filesize

        40KB

        MD5

        a182561a527f929489bf4b8f74f65cd7

        SHA1

        8cd6866594759711ea1836e86a5b7ca64ee8911f

        SHA256

        42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

        SHA512

        9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

      • C:\Users\Admin\AppData\Roaming\47191082\471logim.jpeg

        Filesize

        77KB

        MD5

        dc21f5eb39b15d350362712222df9b01

        SHA1

        21435796ca7efa60c57b87619a63d2ecee8deb9c

        SHA256

        1647943a457b1c50ffd2ff12a1f1fecaa3f88ffea6181e9cbd4a6c62ca64de36

        SHA512

        07ebd3eaaf0f41d3dbc1191fc1ff1424961327760721a440ad59a4fbc663f3566000490752b135531e59727d2f65a3fbfe48ea28b8055d020cfab9b8aaf87b91

      • C:\Users\Admin\AppData\Roaming\47191082\471logrg.ini

        Filesize

        38B

        MD5

        4aadf49fed30e4c9b3fe4a3dd6445ebe

        SHA1

        1e332822167c6f351b99615eada2c30a538ff037

        SHA256

        75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

        SHA512

        eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

      • C:\Users\Admin\AppData\Roaming\47191082\471logri.ini

        Filesize

        40B

        MD5

        d63a82e5d81e02e399090af26db0b9cb

        SHA1

        91d0014c8f54743bba141fd60c9d963f869d76c9

        SHA256

        eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

        SHA512

        38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

      • C:\Users\Admin\AppData\Roaming\47191082\471logrv.ini

        Filesize

        872B

        MD5

        bbc41c78bae6c71e63cb544a6a284d94

        SHA1

        33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

        SHA256

        ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

        SHA512

        0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

      • C:\Windows\win.ini

        Filesize

        123B

        MD5

        6bf517432f65eb7f0d18d574bf14124c

        SHA1

        5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

        SHA256

        6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

        SHA512

        7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

      • memory/3324-21-0x0000000000AE0000-0x0000000000F13000-memory.dmp

        Filesize

        4.2MB

      • memory/3324-23-0x0000000000AE0000-0x0000000000F13000-memory.dmp

        Filesize

        4.2MB

      • memory/3476-26-0x0000000007B00000-0x0000000007BE3000-memory.dmp

        Filesize

        908KB

      • memory/3476-17-0x0000000007B00000-0x0000000007BE3000-memory.dmp

        Filesize

        908KB

      • memory/3476-27-0x0000000008C30000-0x0000000008DB7000-memory.dmp

        Filesize

        1.5MB

      • memory/3476-14-0x000000000AF00000-0x000000000B0A9000-memory.dmp

        Filesize

        1.7MB

      • memory/3476-24-0x000000000AF00000-0x000000000B0A9000-memory.dmp

        Filesize

        1.7MB

      • memory/3784-2-0x0000000002140000-0x0000000002146000-memory.dmp

        Filesize

        24KB

      • memory/3784-9-0x0000000002140000-0x0000000002146000-memory.dmp

        Filesize

        24KB

      • memory/3784-4-0x0000000076F81000-0x00000000770A1000-memory.dmp

        Filesize

        1.1MB

      • memory/3856-10-0x0000000002110000-0x0000000002116000-memory.dmp

        Filesize

        24KB

      • memory/4212-16-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/4212-13-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/4212-11-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB