Resubmissions

16-07-2024 22:15

240716-16kzrswapd 10

16-07-2024 12:42

240716-pxbtyswbqa 10

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    16-07-2024 12:42

General

  • Target

    DHL_TOC2_2407081728458457.pdf.exe

  • Size

    1.0MB

  • MD5

    f6ed869b733b1f2aa3bdd06040f3372a

  • SHA1

    7075acf1c62e44653f5c834a14b56cd342f0ae5a

  • SHA256

    05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1

  • SHA512

    cba7753022eaa43f2d1bc77c73c7276824545e3083eee5e321f8be5b729bad3b01fe84108cbc5bdbe5fca7df1e802a55b36ef19292b1874a1cb514af5c16c582

  • SSDEEP

    24576:PAHnh+eWsN3skA4RV1Hom2KXMmHasscwkKNvvD5:yh+ZkldoPK8Yassht

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rn94

Decoy

st68v.xyz

conciergenotary.net

qwechaotk.top

rtpdonatoto29.xyz

8ad.xyz

powermove.top

cameras-30514.bond

vanguardcoffee.shop

umoe53fxc1bsujv.buzz

consultoriamax.net

hplxx.com

ndu.wtf

yzh478c.xyz

bigbrown999.site

xiake07.asia

resdai.xyz

the35678.shop

ba6rf.rest

ceo688.com

phimxhot.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\DHL_TOC2_2407081728458457.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL_TOC2_2407081728458457.pdf.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Users\Admin\AppData\Local\directory\name.exe
        "C:\Users\Admin\AppData\Local\Temp\DHL_TOC2_2407081728458457.pdf.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\DHL_TOC2_2407081728458457.pdf.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2636
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
          PID:2540

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\niellists

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • \Users\Admin\AppData\Local\directory\name.exe

      Filesize

      1.0MB

      MD5

      f6ed869b733b1f2aa3bdd06040f3372a

      SHA1

      7075acf1c62e44653f5c834a14b56cd342f0ae5a

      SHA256

      05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1

      SHA512

      cba7753022eaa43f2d1bc77c73c7276824545e3083eee5e321f8be5b729bad3b01fe84108cbc5bdbe5fca7df1e802a55b36ef19292b1874a1cb514af5c16c582

    • memory/1260-35-0x00000000052A0000-0x00000000053A0000-memory.dmp

      Filesize

      1024KB

    • memory/1260-46-0x0000000007640000-0x000000000779A000-memory.dmp

      Filesize

      1.4MB

    • memory/1260-40-0x0000000007640000-0x000000000779A000-memory.dmp

      Filesize

      1.4MB

    • memory/1260-37-0x00000000052A0000-0x00000000053A0000-memory.dmp

      Filesize

      1024KB

    • memory/2572-41-0x0000000000690000-0x0000000000911000-memory.dmp

      Filesize

      2.5MB

    • memory/2572-42-0x0000000000690000-0x0000000000911000-memory.dmp

      Filesize

      2.5MB

    • memory/2572-43-0x00000000000C0000-0x00000000000EF000-memory.dmp

      Filesize

      188KB

    • memory/2636-32-0x0000000000910000-0x0000000000C13000-memory.dmp

      Filesize

      3.0MB

    • memory/2636-33-0x0000000000180000-0x0000000000195000-memory.dmp

      Filesize

      84KB

    • memory/2636-39-0x0000000000210000-0x0000000000225000-memory.dmp

      Filesize

      84KB

    • memory/2636-34-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2636-38-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2636-30-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2708-10-0x00000000000A0000-0x00000000000A4000-memory.dmp

      Filesize

      16KB