Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 05:56

General

  • Target

    Doc20189700.exe

  • Size

    545KB

  • MD5

    7bce7d55931c5f34701501a38aa95cd3

  • SHA1

    7af77f1afe68b94a6617ac9a1ed5d21b66ca4008

  • SHA256

    742be802e5d909d41c46fd374e6682f0467003e03f5387f37fe18d407322e5a5

  • SHA512

    7bb4e470452a1f0dcd2bcc247c179d3c41b3fdac2aa694f6c79f7af71605226648ad3b57129f3930f85c7b10fc4329a622cbb7ffc27fe9fbb1b7aa4258a742c7

  • SSDEEP

    12288:WwSpsazDx3ScS946sj0kBFZWHcupoC+22bFK9Z47:1yDzcn4jrZTrJbG4

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

h323

Decoy

sanfransiscolotto.com

mcginnisformayor.com

puer-energy.net

hieusport.com

alevelcourse.net

excelcium-promotion.info

waehlergemeinschaft-bergen.com

capstone-asphalt.com

ppacspromsecureproved3.info

bm9993.com

zhuozixf119.com

sgy64dq.ink

qukuaifun.com

boletosdeavion.store

ministeriofaceaface.com

xn--fiq06lpuc3zab58o04p.com

sunglassessales.win

jano.tech

tillillishop.com

tyty544.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3432
    • C:\Users\Admin\AppData\Local\Temp\Doc20189700.exe
      "C:\Users\Admin\AppData\Local\Temp\Doc20189700.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4584
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\Doc20189700.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\kist.exe"
        3⤵
          PID:4768
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\kist.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4536
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\kist.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\kist.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5036
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\kist.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\kist.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:2572
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\SysWOW64\svchost.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\kist.exe"
          3⤵
            PID:4692

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\kist.exe

        Filesize

        545KB

        MD5

        7bce7d55931c5f34701501a38aa95cd3

        SHA1

        7af77f1afe68b94a6617ac9a1ed5d21b66ca4008

        SHA256

        742be802e5d909d41c46fd374e6682f0467003e03f5387f37fe18d407322e5a5

        SHA512

        7bb4e470452a1f0dcd2bcc247c179d3c41b3fdac2aa694f6c79f7af71605226648ad3b57129f3930f85c7b10fc4329a622cbb7ffc27fe9fbb1b7aa4258a742c7

      • memory/1132-28-0x0000000000A80000-0x0000000000A8E000-memory.dmp

        Filesize

        56KB

      • memory/1132-27-0x0000000000A80000-0x0000000000A8E000-memory.dmp

        Filesize

        56KB

      • memory/2572-29-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/2572-24-0x0000000001200000-0x000000000154A000-memory.dmp

        Filesize

        3.3MB

      • memory/2572-20-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/3432-34-0x00000000081C0000-0x0000000008257000-memory.dmp

        Filesize

        604KB

      • memory/3432-32-0x0000000002DF0000-0x0000000002ED2000-memory.dmp

        Filesize

        904KB

      • memory/3432-26-0x0000000002DF0000-0x0000000002ED2000-memory.dmp

        Filesize

        904KB

      • memory/4584-6-0x0000000074F20000-0x00000000756D0000-memory.dmp

        Filesize

        7.7MB

      • memory/4584-0-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

        Filesize

        4KB

      • memory/4584-1-0x0000000000D90000-0x0000000000E20000-memory.dmp

        Filesize

        576KB

      • memory/4584-2-0x0000000005D30000-0x00000000062D4000-memory.dmp

        Filesize

        5.6MB

      • memory/4584-3-0x0000000005820000-0x00000000058B2000-memory.dmp

        Filesize

        584KB

      • memory/4584-4-0x0000000005B60000-0x0000000005BF8000-memory.dmp

        Filesize

        608KB

      • memory/4584-11-0x0000000074F20000-0x00000000756D0000-memory.dmp

        Filesize

        7.7MB

      • memory/4584-5-0x00000000057F0000-0x000000000580E000-memory.dmp

        Filesize

        120KB

      • memory/4584-7-0x0000000003110000-0x000000000311A000-memory.dmp

        Filesize

        40KB

      • memory/5036-18-0x0000000074F20000-0x00000000756D0000-memory.dmp

        Filesize

        7.7MB

      • memory/5036-23-0x0000000074F20000-0x00000000756D0000-memory.dmp

        Filesize

        7.7MB

      • memory/5036-19-0x0000000074F20000-0x00000000756D0000-memory.dmp

        Filesize

        7.7MB

      • memory/5036-15-0x0000000074F20000-0x00000000756D0000-memory.dmp

        Filesize

        7.7MB

      • memory/5036-17-0x0000000008AA0000-0x0000000008B3C000-memory.dmp

        Filesize

        624KB

      • memory/5036-16-0x0000000074F20000-0x00000000756D0000-memory.dmp

        Filesize

        7.7MB