Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-07-2024 06:40

General

  • Target

    9RogliUNrK3XMIU.exe

  • Size

    636KB

  • MD5

    66645c931f0efe0978e4e6f3a208355a

  • SHA1

    a8d4f42410e8c03afbe6edff9fb7515811590f7f

  • SHA256

    b362ced287b5f00b3b2ab2c3a7bbc85b57e13271d76a6c65423a831fde92876c

  • SHA512

    7ee22cbc3f80cf079a47fc6c1aff047e3c48106b8b800163227be0d2bb1530654876503947ab75e44b2bcd0a89e89261c9e85c329e46d8f19ec3375e4e9a852e

  • SSDEEP

    12288:O5bmfm3V8eY73Sv9+Vcfx4sWo7FxpLq0ubuIKOTeh2AQdRlF6U:IQ73a9+Vcl7FxpG0dhqemRv6U

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

v15n

Decoy

dyahwoahjuk.store

toysstorm.com

y7rak9.com

2222233p6.shop

betbox2341.com

visualvarta.com

nijssenadventures.com

main-12.site

leng4d.net

kurainu.xyz

hatesa.xyz

culturamosaica.com

supermallify.store

gigboard.app

rxforgive.com

ameliestones.com

kapalwin.live

tier.credit

sobol-ksa.com

faredeal.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3588
    • C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe
      "C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4808
      • C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe
        "C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"
        3⤵
          PID:3232
        • C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe
          "C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1508
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:1408
        • C:\Windows\SysWOW64\help.exe
          "C:\Windows\SysWOW64\help.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5044
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\9RogliUNrK3XMIU.exe"
            3⤵
              PID:4348

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1508-10-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1508-15-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1508-16-0x0000000000D70000-0x0000000000D85000-memory.dmp

          Filesize

          84KB

        • memory/1508-13-0x00000000012F0000-0x000000000163A000-memory.dmp

          Filesize

          3.3MB

        • memory/3588-17-0x0000000002D50000-0x0000000002E23000-memory.dmp

          Filesize

          844KB

        • memory/3588-22-0x0000000002D50000-0x0000000002E23000-memory.dmp

          Filesize

          844KB

        • memory/3588-28-0x0000000007470000-0x000000000756A000-memory.dmp

          Filesize

          1000KB

        • memory/3588-25-0x0000000007470000-0x000000000756A000-memory.dmp

          Filesize

          1000KB

        • memory/3588-24-0x0000000007470000-0x000000000756A000-memory.dmp

          Filesize

          1000KB

        • memory/4808-2-0x0000000005EC0000-0x0000000006464000-memory.dmp

          Filesize

          5.6MB

        • memory/4808-9-0x0000000009530000-0x00000000095CC000-memory.dmp

          Filesize

          624KB

        • memory/4808-12-0x0000000074E70000-0x0000000075620000-memory.dmp

          Filesize

          7.7MB

        • memory/4808-3-0x0000000005820000-0x00000000058B2000-memory.dmp

          Filesize

          584KB

        • memory/4808-5-0x0000000074E70000-0x0000000075620000-memory.dmp

          Filesize

          7.7MB

        • memory/4808-1-0x0000000000ED0000-0x0000000000F72000-memory.dmp

          Filesize

          648KB

        • memory/4808-0-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

          Filesize

          4KB

        • memory/4808-6-0x0000000005E90000-0x0000000005EAA000-memory.dmp

          Filesize

          104KB

        • memory/4808-7-0x0000000006A70000-0x0000000006A7E000-memory.dmp

          Filesize

          56KB

        • memory/4808-8-0x0000000006AE0000-0x0000000006B56000-memory.dmp

          Filesize

          472KB

        • memory/4808-4-0x00000000058D0000-0x00000000058DA000-memory.dmp

          Filesize

          40KB

        • memory/5044-20-0x0000000000B00000-0x0000000000B2F000-memory.dmp

          Filesize

          188KB

        • memory/5044-18-0x00000000001F0000-0x00000000001F7000-memory.dmp

          Filesize

          28KB

        • memory/5044-19-0x00000000001F0000-0x00000000001F7000-memory.dmp

          Filesize

          28KB