Analysis

  • max time kernel
    25s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    14-07-2024 21:23

General

  • Target

    2200b8da7972eb3348a0088d1b8147c0N.exe

  • Size

    772KB

  • MD5

    2200b8da7972eb3348a0088d1b8147c0

  • SHA1

    0ba3ddefd855519594cc6865ea4ebd9ce5bdb235

  • SHA256

    3335161ade4a4cc3865415f0e0b15e9fcedfd2ea6341b6d2d3848bd1e3b5d607

  • SHA512

    554d59e17aca85ff1be7d4892d59c7b867f9c2c6be2fbf32501034bffc437f6c75570ad31aa4c0054833a405f03e0d749602072fcf0d6af7fd3235381cc732c4

  • SSDEEP

    24576:t0mljjkY881WPQSiyQt1GUS25p97k6ni:iM3kN895t1Gy5pxk6

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

qt22

Decoy

tryventura.co

cashstash.online

keiramcwilliams.site

ytdnb558.com

huq.homes

ib999.cc

ivy001.com

militaryjobs.site

mfhospitality.net

landtour-outdoor.com

cosmicdustclub.com

ssskjv.com

bigremporium.com

network221.com

thegfshops.com

iase.in

alliednp.com

tprovenance.io

massimaidratazione.com

dominodarts.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2200b8da7972eb3348a0088d1b8147c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2200b8da7972eb3348a0088d1b8147c0N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Users\Admin\AppData\Local\Temp\2200b8da7972eb3348a0088d1b8147c0N.exe
      "C:\Users\Admin\AppData\Local\Temp\2200b8da7972eb3348a0088d1b8147c0N.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2292-6-0x0000000005320000-0x0000000005396000-memory.dmp

    Filesize

    472KB

  • memory/2292-8-0x00000000746D0000-0x0000000074DBE000-memory.dmp

    Filesize

    6.9MB

  • memory/2292-2-0x00000000746D0000-0x0000000074DBE000-memory.dmp

    Filesize

    6.9MB

  • memory/2292-3-0x0000000004790000-0x000000000481A000-memory.dmp

    Filesize

    552KB

  • memory/2292-4-0x0000000000510000-0x0000000000520000-memory.dmp

    Filesize

    64KB

  • memory/2292-5-0x0000000000720000-0x000000000072E000-memory.dmp

    Filesize

    56KB

  • memory/2292-1-0x0000000000B10000-0x0000000000BD8000-memory.dmp

    Filesize

    800KB

  • memory/2292-7-0x00000000746DE000-0x00000000746DF000-memory.dmp

    Filesize

    4KB

  • memory/2292-0-0x00000000746DE000-0x00000000746DF000-memory.dmp

    Filesize

    4KB

  • memory/2292-14-0x00000000746D0000-0x0000000074DBE000-memory.dmp

    Filesize

    6.9MB

  • memory/2668-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2668-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2668-10-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2668-9-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2668-15-0x0000000000BE0000-0x0000000000EE3000-memory.dmp

    Filesize

    3.0MB