Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-07-2024 17:01

General

  • Target

    MalwareBazaar.exe

  • Size

    677KB

  • MD5

    978af787e7c03fa3cb90bc9cecf33862

  • SHA1

    c7748a8f4b34af3a8e76e1583ac14cd95c32ac9e

  • SHA256

    2a346621e42f809c9cbfaf01bd2baa682838165f5e24c7c945f855671fc457e4

  • SHA512

    943269d4678ca4de5f45ca891b3eecdbd6c5835c53055c246bfd918beaea6f09c4c0a2b263ec687a7440a4d0b492a4089aa168c6d80f5d36b89a4f9669d71ca6

  • SSDEEP

    12288:bUME/4AgZ9n0Ao3NX0pQm0FSD8GBkxb3fOOE7MxIpNu4jOtM/u61IVA:FE/4AgX0AL108AGBE3fu1jOeW61IVA

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

v15n

Decoy

dyahwoahjuk.store

toysstorm.com

y7rak9.com

2222233p6.shop

betbox2341.com

visualvarta.com

nijssenadventures.com

main-12.site

leng4d.net

kurainu.xyz

hatesa.xyz

culturamosaica.com

supermallify.store

gigboard.app

rxforgive.com

ameliestones.com

kapalwin.live

tier.credit

sobol-ksa.com

faredeal.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
      "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
        "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1256
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Gathers network information
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
        3⤵
          PID:3984

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1256-10-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1256-20-0x0000000003730000-0x0000000003745000-memory.dmp

      Filesize

      84KB

    • memory/1256-19-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1256-16-0x00000000019C0000-0x00000000019D5000-memory.dmp

      Filesize

      84KB

    • memory/1256-15-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1256-13-0x0000000001AC0000-0x0000000001E0A000-memory.dmp

      Filesize

      3.3MB

    • memory/3412-21-0x0000000002AC0000-0x0000000002B77000-memory.dmp

      Filesize

      732KB

    • memory/3412-33-0x0000000007240000-0x00000000072F9000-memory.dmp

      Filesize

      740KB

    • memory/3412-29-0x0000000007240000-0x00000000072F9000-memory.dmp

      Filesize

      740KB

    • memory/3412-27-0x0000000002AC0000-0x0000000002B77000-memory.dmp

      Filesize

      732KB

    • memory/3412-28-0x0000000007240000-0x00000000072F9000-memory.dmp

      Filesize

      740KB

    • memory/3412-26-0x0000000008620000-0x0000000008780000-memory.dmp

      Filesize

      1.4MB

    • memory/3412-17-0x0000000008620000-0x0000000008780000-memory.dmp

      Filesize

      1.4MB

    • memory/4392-22-0x0000000000D80000-0x0000000000D8B000-memory.dmp

      Filesize

      44KB

    • memory/4392-24-0x0000000001260000-0x000000000128F000-memory.dmp

      Filesize

      188KB

    • memory/4392-23-0x0000000000D80000-0x0000000000D8B000-memory.dmp

      Filesize

      44KB

    • memory/5024-5-0x0000000074400000-0x0000000074BB0000-memory.dmp

      Filesize

      7.7MB

    • memory/5024-1-0x0000000000030000-0x00000000000DE000-memory.dmp

      Filesize

      696KB

    • memory/5024-0-0x000000007440E000-0x000000007440F000-memory.dmp

      Filesize

      4KB

    • memory/5024-2-0x0000000005060000-0x0000000005604000-memory.dmp

      Filesize

      5.6MB

    • memory/5024-3-0x0000000004B50000-0x0000000004BE2000-memory.dmp

      Filesize

      584KB

    • memory/5024-4-0x0000000004AE0000-0x0000000004AEA000-memory.dmp

      Filesize

      40KB

    • memory/5024-7-0x0000000005030000-0x000000000503E000-memory.dmp

      Filesize

      56KB

    • memory/5024-12-0x0000000074400000-0x0000000074BB0000-memory.dmp

      Filesize

      7.7MB

    • memory/5024-6-0x0000000004D60000-0x0000000004D7A000-memory.dmp

      Filesize

      104KB

    • memory/5024-9-0x00000000084D0000-0x000000000856C000-memory.dmp

      Filesize

      624KB

    • memory/5024-8-0x0000000005D10000-0x0000000005D86000-memory.dmp

      Filesize

      472KB