Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-07-2024 15:35

General

  • Target

    DHL_UOC2_240708172813545.pdf.exe

  • Size

    1.0MB

  • MD5

    2465ce9d09372c4daf8a9d6d36c11915

  • SHA1

    08e205473e1bf912fe01e7183cc4e7f880f0e86c

  • SHA256

    fa9ea4e8935d55eb5ef1846b525f02572e147be07c11588e55475e1d7a173676

  • SHA512

    137e60039c82e7ace769a7914050b0dd7152a57780f4dcb7e6df0ad818fe38f45b2fc0e1ff4eb0d2f0d86cbc6fb0b1cdb74aafb224709755c390a2c390f5fed4

  • SSDEEP

    24576:EAHnh+eWsN3skA4RV1Hom2KXMmHa4N1hfjVEc5:Th+ZkldoPK8Ya4NvbVX

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rn94

Decoy

st68v.xyz

conciergenotary.net

qwechaotk.top

rtpdonatoto29.xyz

8ad.xyz

powermove.top

cameras-30514.bond

vanguardcoffee.shop

umoe53fxc1bsujv.buzz

consultoriamax.net

hplxx.com

ndu.wtf

yzh478c.xyz

bigbrown999.site

xiake07.asia

resdai.xyz

the35678.shop

ba6rf.rest

ceo688.com

phimxhot.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3344
    • C:\Users\Admin\AppData\Local\Temp\DHL_UOC2_240708172813545.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL_UOC2_240708172813545.pdf.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1656
      • C:\Users\Admin\AppData\Local\directory\name.exe
        "C:\Users\Admin\AppData\Local\Temp\DHL_UOC2_240708172813545.pdf.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:5072
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\DHL_UOC2_240708172813545.pdf.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:3332
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
          PID:2324

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\anaboly

      Filesize

      185KB

      MD5

      1c95c1e5415911bbac633536ebceabda

      SHA1

      2c71566ac288b115b4b94d4b0facfad2f5643483

      SHA256

      475a0354d1eae20ebbdb55e8ba86a4eef341b22246cf202ec834c4af03980a3a

      SHA512

      e606df44ff8871d14ff84ebb0781b15884c2df36100ecd3b7dc9c7407761494a7ab3e9f1ddc8eeecf79d051416ece07fe54a9735738f04bf3a1b8d4be38c43e3

    • C:\Users\Admin\AppData\Local\Temp\unnervousness

      Filesize

      28KB

      MD5

      8de38e7797a6470be9995a7f809b0ce1

      SHA1

      663e73bb07e0aa3927fdab180dbc970f3372d190

      SHA256

      e53119a0212391d5aa8a43826a8a166b46f001ecdff29b4f9f25f231dcaea54d

      SHA512

      c9f7293ead1816f44132daf867ee18fcc744754dac83d4eb2101ff00e2c3a096ade79d766e7a45e12989e13ec93a8a469f82dd8f0b850870bf16cf702756e7eb

    • C:\Users\Admin\AppData\Local\directory\name.exe

      Filesize

      1.0MB

      MD5

      2465ce9d09372c4daf8a9d6d36c11915

      SHA1

      08e205473e1bf912fe01e7183cc4e7f880f0e86c

      SHA256

      fa9ea4e8935d55eb5ef1846b525f02572e147be07c11588e55475e1d7a173676

      SHA512

      137e60039c82e7ace769a7914050b0dd7152a57780f4dcb7e6df0ad818fe38f45b2fc0e1ff4eb0d2f0d86cbc6fb0b1cdb74aafb224709755c390a2c390f5fed4

    • memory/1240-39-0x0000000000050000-0x0000000000077000-memory.dmp

      Filesize

      156KB

    • memory/1240-40-0x0000000000980000-0x00000000009AF000-memory.dmp

      Filesize

      188KB

    • memory/1240-38-0x0000000000050000-0x0000000000077000-memory.dmp

      Filesize

      156KB

    • memory/1656-10-0x00000000005B0000-0x00000000005B4000-memory.dmp

      Filesize

      16KB

    • memory/3332-28-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3332-36-0x00000000038E0000-0x00000000038F5000-memory.dmp

      Filesize

      84KB

    • memory/3332-35-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3332-32-0x00000000017C0000-0x00000000017D5000-memory.dmp

      Filesize

      84KB

    • memory/3332-31-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3332-29-0x0000000001A00000-0x0000000001D4A000-memory.dmp

      Filesize

      3.3MB

    • memory/3344-33-0x00000000087A0000-0x000000000890E000-memory.dmp

      Filesize

      1.4MB

    • memory/3344-37-0x00000000084E0000-0x000000000861F000-memory.dmp

      Filesize

      1.2MB

    • memory/3344-42-0x00000000084E0000-0x000000000861F000-memory.dmp

      Filesize

      1.2MB

    • memory/3344-44-0x0000000008280000-0x000000000837E000-memory.dmp

      Filesize

      1016KB

    • memory/3344-45-0x0000000008280000-0x000000000837E000-memory.dmp

      Filesize

      1016KB

    • memory/3344-49-0x0000000008280000-0x000000000837E000-memory.dmp

      Filesize

      1016KB