Analysis

  • max time kernel
    91s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-07-2024 21:23

General

  • Target

    2200b8da7972eb3348a0088d1b8147c0N.exe

  • Size

    772KB

  • MD5

    2200b8da7972eb3348a0088d1b8147c0

  • SHA1

    0ba3ddefd855519594cc6865ea4ebd9ce5bdb235

  • SHA256

    3335161ade4a4cc3865415f0e0b15e9fcedfd2ea6341b6d2d3848bd1e3b5d607

  • SHA512

    554d59e17aca85ff1be7d4892d59c7b867f9c2c6be2fbf32501034bffc437f6c75570ad31aa4c0054833a405f03e0d749602072fcf0d6af7fd3235381cc732c4

  • SSDEEP

    24576:t0mljjkY881WPQSiyQt1GUS25p97k6ni:iM3kN895t1Gy5pxk6

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

qt22

Decoy

tryventura.co

cashstash.online

keiramcwilliams.site

ytdnb558.com

huq.homes

ib999.cc

ivy001.com

militaryjobs.site

mfhospitality.net

landtour-outdoor.com

cosmicdustclub.com

ssskjv.com

bigremporium.com

network221.com

thegfshops.com

iase.in

alliednp.com

tprovenance.io

massimaidratazione.com

dominodarts.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2200b8da7972eb3348a0088d1b8147c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2200b8da7972eb3348a0088d1b8147c0N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Users\Admin\AppData\Local\Temp\2200b8da7972eb3348a0088d1b8147c0N.exe
      "C:\Users\Admin\AppData\Local\Temp\2200b8da7972eb3348a0088d1b8147c0N.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1492-8-0x00000000068F0000-0x00000000068FE000-memory.dmp

    Filesize

    56KB

  • memory/1492-6-0x0000000006D40000-0x0000000006DCA000-memory.dmp

    Filesize

    552KB

  • memory/1492-2-0x0000000005D20000-0x00000000062C4000-memory.dmp

    Filesize

    5.6MB

  • memory/1492-3-0x0000000005690000-0x0000000005722000-memory.dmp

    Filesize

    584KB

  • memory/1492-0-0x00000000750FE000-0x00000000750FF000-memory.dmp

    Filesize

    4KB

  • memory/1492-5-0x00000000750F0000-0x00000000758A0000-memory.dmp

    Filesize

    7.7MB

  • memory/1492-1-0x0000000000BE0000-0x0000000000CA8000-memory.dmp

    Filesize

    800KB

  • memory/1492-7-0x0000000005990000-0x00000000059A0000-memory.dmp

    Filesize

    64KB

  • memory/1492-4-0x0000000005730000-0x000000000573A000-memory.dmp

    Filesize

    40KB

  • memory/1492-9-0x0000000006EF0000-0x0000000006F66000-memory.dmp

    Filesize

    472KB

  • memory/1492-10-0x0000000009230000-0x00000000092CC000-memory.dmp

    Filesize

    624KB

  • memory/1492-11-0x00000000750FE000-0x00000000750FF000-memory.dmp

    Filesize

    4KB

  • memory/1492-16-0x00000000750F0000-0x00000000758A0000-memory.dmp

    Filesize

    7.7MB

  • memory/1492-14-0x00000000750F0000-0x00000000758A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4628-15-0x0000000001AD0000-0x0000000001E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4628-12-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB