Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2024 00:31

General

  • Target

    39311b433f6276e149337d9a2dc1ab00N.exe

  • Size

    628KB

  • MD5

    39311b433f6276e149337d9a2dc1ab00

  • SHA1

    fae8205b2a25d3d3b904352d30b9f986a2e5d653

  • SHA256

    a6c0617a5675430db1e325776159f156c4fba0a6592f87bd4145a614a2163b73

  • SHA512

    ddc3672e209d65221ccdc6ac1a58c4a8d8aea29b617061dd8813f5502547e6de06cdf6dd07e48aa28e3333147bd439dcb33633c97944f3b634f0650209e524cc

  • SSDEEP

    12288:D+Wx2PQfLfEpCv8IFaCvSi07zUQSx2kKpv3YJix+JMmJkm:TwMrYQaCvSHn1tv3Y48Nd

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pz12

Decoy

paucanyes.com

autonwheels.com

cowboysandcaviarbar.com

fitnessengineeredworkouts.com

nuevobajonfavorito.com

dflx8.com

rothability.com

sxybet88.com

onesource.live

brenjitu1904.com

airdrop-zero1labs.com

guangdongqiangzhetc.com

apartments-for-rent-72254.bond

ombak99.lol

qqfoodsolutions.com

kyyzz.com

thepicklematch.com

ainth.com

missorris.com

gabbygomez.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39311b433f6276e149337d9a2dc1ab00N.exe
    "C:\Users\Admin\AppData\Local\Temp\39311b433f6276e149337d9a2dc1ab00N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\39311b433f6276e149337d9a2dc1ab00N.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2744
    • C:\Users\Admin\AppData\Local\Temp\39311b433f6276e149337d9a2dc1ab00N.exe
      "C:\Users\Admin\AppData\Local\Temp\39311b433f6276e149337d9a2dc1ab00N.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1744-0-0x000000007420E000-0x000000007420F000-memory.dmp

    Filesize

    4KB

  • memory/1744-1-0x0000000000CC0000-0x0000000000D62000-memory.dmp

    Filesize

    648KB

  • memory/1744-2-0x0000000074200000-0x00000000748EE000-memory.dmp

    Filesize

    6.9MB

  • memory/1744-3-0x0000000000900000-0x000000000091A000-memory.dmp

    Filesize

    104KB

  • memory/1744-4-0x0000000000A00000-0x0000000000A0E000-memory.dmp

    Filesize

    56KB

  • memory/1744-5-0x0000000005550000-0x00000000055C6000-memory.dmp

    Filesize

    472KB

  • memory/1744-12-0x0000000074200000-0x00000000748EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2648-6-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2648-10-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2648-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2648-7-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2648-11-0x0000000000950000-0x0000000000C53000-memory.dmp

    Filesize

    3.0MB