Analysis

  • max time kernel
    147s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17-07-2024 09:25

General

  • Target

    nell.scr.exe

  • Size

    617KB

  • MD5

    bbb12cd2696ac986ad79c0116da987f4

  • SHA1

    802f65e20825ee6b2b5074e6084bc284241278d8

  • SHA256

    d8e6a83561b9d8dbe84de21795763589d2626904ac6406ddfe2dc2342c4edb8e

  • SHA512

    318e885d898a42b2751d387ba48b6fb359d3665d18637de48f35a53ea525bccbd1d9175a1f0429051d0a714ee887900ad3577db36d31d65f89ba7fb185484911

  • SSDEEP

    12288:G4ndmoGCQmm6f9NKxQYtwk+4oK40FxvBF4Ek3zCVbT/Z7p:TnghCFfHK99b/B6zyT

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

btrd

Decoy

everslane.com

prairieviewelectric.online

dszvhgd.com

papamuch.com

8129k.vip

jeffreestar.gold

bestguestrentals.com

nvzhuang1.net

anangtoto.com

yxfgor.top

practicalpoppers.com

thebestanglephotography.online

koormm.top

criika.net

audioflow.online

380747.net

jiuguanwang.net

bloxequities.com

v321c.com

sugar.monster

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Users\Admin\AppData\Local\Temp\nell.scr.exe
      "C:\Users\Admin\AppData\Local\Temp\nell.scr.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2556
      • C:\Users\Admin\AppData\Local\Temp\nell.scr.exe
        "C:\Users\Admin\AppData\Local\Temp\nell.scr.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1612
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\nell.scr.exe"
        3⤵
        • Deletes itself
        PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1172-15-0x0000000004ED0000-0x0000000004FE0000-memory.dmp

    Filesize

    1.1MB

  • memory/1172-22-0x0000000004ED0000-0x0000000004FE0000-memory.dmp

    Filesize

    1.1MB

  • memory/1612-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1612-10-0x0000000000A40000-0x0000000000D43000-memory.dmp

    Filesize

    3.0MB

  • memory/1612-14-0x0000000000160000-0x0000000000174000-memory.dmp

    Filesize

    80KB

  • memory/1612-9-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1612-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1612-6-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1612-5-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2488-17-0x00000000003D0000-0x00000000003F6000-memory.dmp

    Filesize

    152KB

  • memory/2488-19-0x00000000003D0000-0x00000000003F6000-memory.dmp

    Filesize

    152KB

  • memory/2488-20-0x0000000000070000-0x000000000009F000-memory.dmp

    Filesize

    188KB

  • memory/2556-3-0x0000000073D00000-0x00000000743EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2556-2-0x0000000004160000-0x00000000041C2000-memory.dmp

    Filesize

    392KB

  • memory/2556-4-0x0000000000430000-0x0000000000438000-memory.dmp

    Filesize

    32KB

  • memory/2556-0-0x0000000073D0E000-0x0000000073D0F000-memory.dmp

    Filesize

    4KB

  • memory/2556-16-0x0000000073D00000-0x00000000743EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2556-1-0x00000000009A0000-0x0000000000A40000-memory.dmp

    Filesize

    640KB