Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17-07-2024 08:00

General

  • Target

    rfq27462##.exe

  • Size

    1.0MB

  • MD5

    3f7dbf7df8009d3da5038bbf74a33bee

  • SHA1

    93537e6dcaefff4dbc3981ce46d5aa72924948bc

  • SHA256

    db75da76893e862899d0153d196b570dae368bb1e3623ed9895ead7110922e3a

  • SHA512

    48c740c10aafc936d349cecab510523f70a4874754e217b98c04860305c7fef8d1dd1b3245d2d95dd1ad9bb625f94d9b292ca015712f08bc2fa6d39cae000b47

  • SSDEEP

    24576:yAHnh+eWsN3skA4RV1Hom2KXMmHa8pqDDYDbVpwT5:1h+ZkldoPK8Ya8iYDpp8

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ts59

Decoy

hgptgz684w.top

gas39.pro

totalcow.com

76466.club

ssweatstudio.com

nr35.top

hmstr-drop.site

kjsdhklssk13.xyz

lostaino.com

athenamotel.info

9332946.com

ec-delivery-jobs-8j.bond

complaix.com

824go.com

checkout4xgrow.shop

modleavedepts.online

shoedio54.com

topallinoneaccounting.com

texhio.online

cn-brand.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\rfq27462##.exe
      "C:\Users\Admin\AppData\Local\Temp\rfq27462##.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\rfq27462##.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2180
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
          PID:2480

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1204-25-0x00000000063F0000-0x00000000064CB000-memory.dmp

      Filesize

      876KB

    • memory/1204-16-0x00000000063F0000-0x00000000064CB000-memory.dmp

      Filesize

      876KB

    • memory/1204-41-0x0000000006950000-0x0000000006A93000-memory.dmp

      Filesize

      1.3MB

    • memory/1204-38-0x0000000006950000-0x0000000006A93000-memory.dmp

      Filesize

      1.3MB

    • memory/1204-37-0x0000000006950000-0x0000000006A93000-memory.dmp

      Filesize

      1.3MB

    • memory/1204-24-0x0000000000010000-0x0000000000020000-memory.dmp

      Filesize

      64KB

    • memory/2180-11-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2180-14-0x00000000001D0000-0x00000000001E4000-memory.dmp

      Filesize

      80KB

    • memory/2180-15-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2180-13-0x0000000000790000-0x0000000000A93000-memory.dmp

      Filesize

      3.0MB

    • memory/2568-10-0x00000000000E0000-0x00000000000E4000-memory.dmp

      Filesize

      16KB

    • memory/2976-21-0x0000000000180000-0x000000000018E000-memory.dmp

      Filesize

      56KB

    • memory/2976-22-0x0000000000090000-0x00000000000BF000-memory.dmp

      Filesize

      188KB

    • memory/2976-17-0x0000000000180000-0x000000000018E000-memory.dmp

      Filesize

      56KB

    • memory/2976-18-0x0000000000180000-0x000000000018E000-memory.dmp

      Filesize

      56KB