Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03-07-2024 15:24
General
-
Target
MKCC-MEC-RFQ-115-2024.exe
-
Size
1.0MB
-
MD5
11ab7d8a50ccafbb4d7b5c9e83e4ff4c
-
SHA1
1e0d2f0564e8a8dc7237c98e3facc0e1b4b314cf
-
SHA256
2eb137991ea1e48556d906d1e03bfaed1df13529dd2420031e6fc92b55c076d1
-
SHA512
2e03c60963526576b3a75a488adb607d148888caa4a9be2177479ab762576082e5af2a7a8fd30e019c782dba36dfddc2b1a31c9f36d95bbbbc27a233a2610995
-
SSDEEP
24576:PAHnh+eWsN3skA4RV1Hom2KXMmHat0nexrhALk5:yh+ZkldoPK8YateEt
Malware Config
Extracted
formbook
4.1
ts59
hgptgz684w.top
gas39.pro
totalcow.com
76466.club
ssweatstudio.com
nr35.top
hmstr-drop.site
kjsdhklssk13.xyz
lostaino.com
athenamotel.info
9332946.com
ec-delivery-jobs-8j.bond
complaix.com
824go.com
checkout4xgrow.shop
modleavedepts.online
shoedio54.com
topallinoneaccounting.com
texhio.online
cn-brand.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 4 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MKCC-MEC-RFQ-115-2024.exe"C:\Users\Admin\AppData\Local\Temp\MKCC-MEC-RFQ-115-2024.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\MKCC-MEC-RFQ-115-2024.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 6963⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3888 -ip 38881⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
-
Filesize
188KB
-
Filesize
156KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
1.3MB
-
Filesize
796KB
-
Filesize
1.3MB
-
Filesize
16KB
-
Filesize
80KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
80KB
-
Filesize
188KB