Analysis

  • max time kernel
    148s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17-07-2024 06:40

General

  • Target

    9RogliUNrK3XMIU.exe

  • Size

    636KB

  • MD5

    66645c931f0efe0978e4e6f3a208355a

  • SHA1

    a8d4f42410e8c03afbe6edff9fb7515811590f7f

  • SHA256

    b362ced287b5f00b3b2ab2c3a7bbc85b57e13271d76a6c65423a831fde92876c

  • SHA512

    7ee22cbc3f80cf079a47fc6c1aff047e3c48106b8b800163227be0d2bb1530654876503947ab75e44b2bcd0a89e89261c9e85c329e46d8f19ec3375e4e9a852e

  • SSDEEP

    12288:O5bmfm3V8eY73Sv9+Vcfx4sWo7FxpLq0ubuIKOTeh2AQdRlF6U:IQ73a9+Vcl7FxpG0dhqemRv6U

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

v15n

Decoy

dyahwoahjuk.store

toysstorm.com

y7rak9.com

2222233p6.shop

betbox2341.com

visualvarta.com

nijssenadventures.com

main-12.site

leng4d.net

kurainu.xyz

hatesa.xyz

culturamosaica.com

supermallify.store

gigboard.app

rxforgive.com

ameliestones.com

kapalwin.live

tier.credit

sobol-ksa.com

faredeal.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe
      "C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2556
      • C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe
        "C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2916
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\SysWOW64\control.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"
        3⤵
        • Deletes itself
        PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1180-19-0x00000000050E0000-0x000000000527A000-memory.dmp

    Filesize

    1.6MB

  • memory/1180-25-0x00000000050E0000-0x000000000527A000-memory.dmp

    Filesize

    1.6MB

  • memory/2556-1-0x0000000001140000-0x00000000011E2000-memory.dmp

    Filesize

    648KB

  • memory/2556-2-0x0000000074370000-0x0000000074A5E000-memory.dmp

    Filesize

    6.9MB

  • memory/2556-3-0x00000000003D0000-0x00000000003EA000-memory.dmp

    Filesize

    104KB

  • memory/2556-4-0x0000000000570000-0x000000000057E000-memory.dmp

    Filesize

    56KB

  • memory/2556-5-0x0000000000DF0000-0x0000000000E66000-memory.dmp

    Filesize

    472KB

  • memory/2556-0-0x000000007437E000-0x000000007437F000-memory.dmp

    Filesize

    4KB

  • memory/2556-14-0x0000000074370000-0x0000000074A5E000-memory.dmp

    Filesize

    6.9MB

  • memory/2864-22-0x00000000000C0000-0x00000000000EF000-memory.dmp

    Filesize

    188KB

  • memory/2864-20-0x0000000000D20000-0x0000000000D3F000-memory.dmp

    Filesize

    124KB

  • memory/2864-21-0x0000000000D20000-0x0000000000D3F000-memory.dmp

    Filesize

    124KB

  • memory/2916-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2916-17-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2916-18-0x0000000000180000-0x0000000000195000-memory.dmp

    Filesize

    84KB

  • memory/2916-15-0x00000000009A0000-0x0000000000CA3000-memory.dmp

    Filesize

    3.0MB

  • memory/2916-8-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2916-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2916-6-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB