Analysis

  • max time kernel
    146s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-07-2024 08:00

General

  • Target

    rfq27462##.exe

  • Size

    1.0MB

  • MD5

    3f7dbf7df8009d3da5038bbf74a33bee

  • SHA1

    93537e6dcaefff4dbc3981ce46d5aa72924948bc

  • SHA256

    db75da76893e862899d0153d196b570dae368bb1e3623ed9895ead7110922e3a

  • SHA512

    48c740c10aafc936d349cecab510523f70a4874754e217b98c04860305c7fef8d1dd1b3245d2d95dd1ad9bb625f94d9b292ca015712f08bc2fa6d39cae000b47

  • SSDEEP

    24576:yAHnh+eWsN3skA4RV1Hom2KXMmHa8pqDDYDbVpwT5:1h+ZkldoPK8Ya8iYDpp8

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ts59

Decoy

hgptgz684w.top

gas39.pro

totalcow.com

76466.club

ssweatstudio.com

nr35.top

hmstr-drop.site

kjsdhklssk13.xyz

lostaino.com

athenamotel.info

9332946.com

ec-delivery-jobs-8j.bond

complaix.com

824go.com

checkout4xgrow.shop

modleavedepts.online

shoedio54.com

topallinoneaccounting.com

texhio.online

cn-brand.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Users\Admin\AppData\Local\Temp\rfq27462##.exe
      "C:\Users\Admin\AppData\Local\Temp\rfq27462##.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\rfq27462##.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:5016
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\SysWOW64\netsh.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:880
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
          PID:4388

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/880-19-0x00000000014E0000-0x00000000014FE000-memory.dmp

      Filesize

      120KB

    • memory/880-17-0x00000000014E0000-0x00000000014FE000-memory.dmp

      Filesize

      120KB

    • memory/880-20-0x00000000003A0000-0x00000000003CF000-memory.dmp

      Filesize

      188KB

    • memory/3356-16-0x0000000007290000-0x0000000007347000-memory.dmp

      Filesize

      732KB

    • memory/3356-24-0x0000000007730000-0x00000000077EA000-memory.dmp

      Filesize

      744KB

    • memory/3356-25-0x0000000007730000-0x00000000077EA000-memory.dmp

      Filesize

      744KB

    • memory/3356-28-0x0000000007730000-0x00000000077EA000-memory.dmp

      Filesize

      744KB

    • memory/4696-10-0x0000000003FF0000-0x0000000003FF4000-memory.dmp

      Filesize

      16KB

    • memory/5016-11-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/5016-12-0x0000000001600000-0x000000000194A000-memory.dmp

      Filesize

      3.3MB

    • memory/5016-14-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/5016-15-0x0000000001A80000-0x0000000001A94000-memory.dmp

      Filesize

      80KB