Analysis

  • max time kernel
    147s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    17-07-2024 15:09

General

  • Target

    05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1.exe

  • Size

    1.0MB

  • MD5

    f6ed869b733b1f2aa3bdd06040f3372a

  • SHA1

    7075acf1c62e44653f5c834a14b56cd342f0ae5a

  • SHA256

    05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1

  • SHA512

    cba7753022eaa43f2d1bc77c73c7276824545e3083eee5e321f8be5b729bad3b01fe84108cbc5bdbe5fca7df1e802a55b36ef19292b1874a1cb514af5c16c582

  • SSDEEP

    24576:PAHnh+eWsN3skA4RV1Hom2KXMmHasscwkKNvvD5:yh+ZkldoPK8Yassht

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rn94

Decoy

st68v.xyz

conciergenotary.net

qwechaotk.top

rtpdonatoto29.xyz

8ad.xyz

powermove.top

cameras-30514.bond

vanguardcoffee.shop

umoe53fxc1bsujv.buzz

consultoriamax.net

hplxx.com

ndu.wtf

yzh478c.xyz

bigbrown999.site

xiake07.asia

resdai.xyz

the35678.shop

ba6rf.rest

ceo688.com

phimxhot.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Users\Admin\AppData\Local\Temp\05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1.exe
      "C:\Users\Admin\AppData\Local\Temp\05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Users\Admin\AppData\Local\directory\name.exe
        "C:\Users\Admin\AppData\Local\Temp\05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2460
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:2796
      • C:\Windows\SysWOW64\autofmt.exe
        "C:\Windows\SysWOW64\autofmt.exe"
        2⤵
          PID:2812
        • C:\Windows\SysWOW64\autofmt.exe
          "C:\Windows\SysWOW64\autofmt.exe"
          2⤵
            PID:2816
          • C:\Windows\SysWOW64\autofmt.exe
            "C:\Windows\SysWOW64\autofmt.exe"
            2⤵
              PID:2840
            • C:\Windows\SysWOW64\autofmt.exe
              "C:\Windows\SysWOW64\autofmt.exe"
              2⤵
                PID:2844
              • C:\Windows\SysWOW64\autofmt.exe
                "C:\Windows\SysWOW64\autofmt.exe"
                2⤵
                  PID:2800
                • C:\Windows\SysWOW64\autofmt.exe
                  "C:\Windows\SysWOW64\autofmt.exe"
                  2⤵
                    PID:2740
                  • C:\Windows\SysWOW64\autofmt.exe
                    "C:\Windows\SysWOW64\autofmt.exe"
                    2⤵
                      PID:2724
                    • C:\Windows\SysWOW64\autofmt.exe
                      "C:\Windows\SysWOW64\autofmt.exe"
                      2⤵
                        PID:2900
                      • C:\Windows\SysWOW64\autofmt.exe
                        "C:\Windows\SysWOW64\autofmt.exe"
                        2⤵
                          PID:2828
                        • C:\Windows\SysWOW64\cmstp.exe
                          "C:\Windows\SysWOW64\cmstp.exe"
                          2⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2836
                          • C:\Windows\SysWOW64\cmd.exe
                            /c del "C:\Windows\SysWOW64\svchost.exe"
                            3⤵
                              PID:2904

                        Network

                        MITRE ATT&CK Matrix

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\niellists

                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                        • \Users\Admin\AppData\Local\directory\name.exe

                          Filesize

                          1.0MB

                          MD5

                          f6ed869b733b1f2aa3bdd06040f3372a

                          SHA1

                          7075acf1c62e44653f5c834a14b56cd342f0ae5a

                          SHA256

                          05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1

                          SHA512

                          cba7753022eaa43f2d1bc77c73c7276824545e3083eee5e321f8be5b729bad3b01fe84108cbc5bdbe5fca7df1e802a55b36ef19292b1874a1cb514af5c16c582

                        • memory/1216-36-0x00000000056C0000-0x0000000005791000-memory.dmp

                          Filesize

                          836KB

                        • memory/1216-42-0x00000000056C0000-0x0000000005791000-memory.dmp

                          Filesize

                          836KB

                        • memory/1216-33-0x00000000040A0000-0x00000000041A0000-memory.dmp

                          Filesize

                          1024KB

                        • memory/2460-30-0x0000000000400000-0x000000000042F000-memory.dmp

                          Filesize

                          188KB

                        • memory/2460-34-0x0000000000400000-0x000000000042F000-memory.dmp

                          Filesize

                          188KB

                        • memory/2460-35-0x0000000000180000-0x0000000000195000-memory.dmp

                          Filesize

                          84KB

                        • memory/2460-31-0x0000000000D30000-0x0000000001033000-memory.dmp

                          Filesize

                          3.0MB

                        • memory/2576-10-0x00000000000E0000-0x00000000000E4000-memory.dmp

                          Filesize

                          16KB

                        • memory/2836-38-0x0000000000D10000-0x0000000000D28000-memory.dmp

                          Filesize

                          96KB

                        • memory/2836-37-0x0000000000D10000-0x0000000000D28000-memory.dmp

                          Filesize

                          96KB

                        • memory/2836-39-0x0000000000090000-0x00000000000BF000-memory.dmp

                          Filesize

                          188KB