Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-07-2024 09:25

General

  • Target

    nell.scr.exe

  • Size

    617KB

  • MD5

    bbb12cd2696ac986ad79c0116da987f4

  • SHA1

    802f65e20825ee6b2b5074e6084bc284241278d8

  • SHA256

    d8e6a83561b9d8dbe84de21795763589d2626904ac6406ddfe2dc2342c4edb8e

  • SHA512

    318e885d898a42b2751d387ba48b6fb359d3665d18637de48f35a53ea525bccbd1d9175a1f0429051d0a714ee887900ad3577db36d31d65f89ba7fb185484911

  • SSDEEP

    12288:G4ndmoGCQmm6f9NKxQYtwk+4oK40FxvBF4Ek3zCVbT/Z7p:TnghCFfHK99b/B6zyT

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

btrd

Decoy

everslane.com

prairieviewelectric.online

dszvhgd.com

papamuch.com

8129k.vip

jeffreestar.gold

bestguestrentals.com

nvzhuang1.net

anangtoto.com

yxfgor.top

practicalpoppers.com

thebestanglephotography.online

koormm.top

criika.net

audioflow.online

380747.net

jiuguanwang.net

bloxequities.com

v321c.com

sugar.monster

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Users\Admin\AppData\Local\Temp\nell.scr.exe
      "C:\Users\Admin\AppData\Local\Temp\nell.scr.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Users\Admin\AppData\Local\Temp\nell.scr.exe
        "C:\Users\Admin\AppData\Local\Temp\nell.scr.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:532
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\nell.scr.exe"
        3⤵
          PID:3092

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/532-9-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/532-12-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/532-13-0x00000000015C0000-0x00000000015D4000-memory.dmp

      Filesize

      80KB

    • memory/532-10-0x00000000010A0000-0x00000000013EA000-memory.dmp

      Filesize

      3.3MB

    • memory/3064-5-0x00000000057E0000-0x00000000057EA000-memory.dmp

      Filesize

      40KB

    • memory/3064-1-0x0000000000B40000-0x0000000000BE0000-memory.dmp

      Filesize

      640KB

    • memory/3064-6-0x0000000005820000-0x0000000005882000-memory.dmp

      Filesize

      392KB

    • memory/3064-7-0x0000000005940000-0x00000000059DC000-memory.dmp

      Filesize

      624KB

    • memory/3064-8-0x0000000005890000-0x0000000005898000-memory.dmp

      Filesize

      32KB

    • memory/3064-4-0x0000000074C40000-0x00000000753F0000-memory.dmp

      Filesize

      7.7MB

    • memory/3064-3-0x00000000055D0000-0x0000000005662000-memory.dmp

      Filesize

      584KB

    • memory/3064-2-0x0000000005AA0000-0x0000000006044000-memory.dmp

      Filesize

      5.6MB

    • memory/3064-16-0x0000000074C40000-0x00000000753F0000-memory.dmp

      Filesize

      7.7MB

    • memory/3064-0-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

      Filesize

      4KB

    • memory/3464-14-0x0000000008D10000-0x0000000008EB1000-memory.dmp

      Filesize

      1.6MB

    • memory/3464-21-0x0000000008D10000-0x0000000008EB1000-memory.dmp

      Filesize

      1.6MB

    • memory/3464-24-0x0000000002F60000-0x0000000003059000-memory.dmp

      Filesize

      996KB

    • memory/3464-25-0x0000000002F60000-0x0000000003059000-memory.dmp

      Filesize

      996KB

    • memory/3464-28-0x0000000002F60000-0x0000000003059000-memory.dmp

      Filesize

      996KB

    • memory/4680-17-0x00000000005C0000-0x0000000000617000-memory.dmp

      Filesize

      348KB

    • memory/4680-18-0x00000000005C0000-0x0000000000617000-memory.dmp

      Filesize

      348KB

    • memory/4680-19-0x0000000000760000-0x000000000078F000-memory.dmp

      Filesize

      188KB