Analysis

  • max time kernel
    147s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2024 03:38

General

  • Target

    05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1.exe

  • Size

    1.0MB

  • MD5

    f6ed869b733b1f2aa3bdd06040f3372a

  • SHA1

    7075acf1c62e44653f5c834a14b56cd342f0ae5a

  • SHA256

    05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1

  • SHA512

    cba7753022eaa43f2d1bc77c73c7276824545e3083eee5e321f8be5b729bad3b01fe84108cbc5bdbe5fca7df1e802a55b36ef19292b1874a1cb514af5c16c582

  • SSDEEP

    24576:PAHnh+eWsN3skA4RV1Hom2KXMmHasscwkKNvvD5:yh+ZkldoPK8Yassht

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rn94

Decoy

st68v.xyz

conciergenotary.net

qwechaotk.top

rtpdonatoto29.xyz

8ad.xyz

powermove.top

cameras-30514.bond

vanguardcoffee.shop

umoe53fxc1bsujv.buzz

consultoriamax.net

hplxx.com

ndu.wtf

yzh478c.xyz

bigbrown999.site

xiake07.asia

resdai.xyz

the35678.shop

ba6rf.rest

ceo688.com

phimxhot.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1216
      • C:\Users\Admin\AppData\Local\Temp\05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1.exe
        "C:\Users\Admin\AppData\Local\Temp\05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Users\Admin\AppData\Local\directory\name.exe
          "C:\Users\Admin\AppData\Local\Temp\05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1.exe"
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:3028
          • C:\Windows\SysWOW64\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1.exe"
            4⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2668
            • C:\Windows\SysWOW64\help.exe
              "C:\Windows\SysWOW64\help.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2828
              • C:\Windows\SysWOW64\cmd.exe
                /c del "C:\Windows\SysWOW64\svchost.exe"
                6⤵
                  PID:2604

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Mazatl

        Filesize

        28KB

        MD5

        e0a5cf114d58f8ee0ff4291a867fd137

        SHA1

        1b158ff65388347954508f5b7f199371e19223e3

        SHA256

        eafeb8c80d4ad126dadef3f52db44f656a8aeef68287af04a50e6fa881b9140e

        SHA512

        8546fef189b766616f1d99e98dba8b46809e2f5097c7ab931096ff3838439a2e18b4a2a61cbd0d318c0aa0ff014e883711210f5cdeaa6a021aaa57f628fb7ac4

      • C:\Users\Admin\AppData\Local\Temp\niellists

        Filesize

        185KB

        MD5

        58078733b08c9abd4a1d6945eedd33f7

        SHA1

        9d3b0fa2d1d78bc91875e656c82ac9c0a78ab5e2

        SHA256

        b9934664b8c472743c1170afd0acfbbc1d6a299ade5451e4dfd7dee18d1a60c7

        SHA512

        87b2f00bb55166bfc1d3da8a3f65648fb9cc0690ccd47ec70f589be1808351c13904fc9ab8e2b253e59ff1e8d90e4e75d22f106627312ca26d2ff098166a2f40

      • \Users\Admin\AppData\Local\directory\name.exe

        Filesize

        1.0MB

        MD5

        f6ed869b733b1f2aa3bdd06040f3372a

        SHA1

        7075acf1c62e44653f5c834a14b56cd342f0ae5a

        SHA256

        05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1

        SHA512

        cba7753022eaa43f2d1bc77c73c7276824545e3083eee5e321f8be5b729bad3b01fe84108cbc5bdbe5fca7df1e802a55b36ef19292b1874a1cb514af5c16c582

      • memory/1216-42-0x0000000004FE0000-0x000000000513A000-memory.dmp

        Filesize

        1.4MB

      • memory/1216-37-0x00000000043A0000-0x00000000045A0000-memory.dmp

        Filesize

        2.0MB

      • memory/1216-46-0x0000000004FE0000-0x000000000513A000-memory.dmp

        Filesize

        1.4MB

      • memory/1216-38-0x0000000004B00000-0x0000000004C00000-memory.dmp

        Filesize

        1024KB

      • memory/1484-10-0x0000000000320000-0x0000000000430000-memory.dmp

        Filesize

        1.1MB

      • memory/1484-16-0x0000000000320000-0x0000000000430000-memory.dmp

        Filesize

        1.1MB

      • memory/2668-33-0x0000000000930000-0x0000000000C33000-memory.dmp

        Filesize

        3.0MB

      • memory/2668-35-0x0000000000150000-0x0000000000165000-memory.dmp

        Filesize

        84KB

      • memory/2668-36-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/2668-32-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/2668-41-0x0000000000280000-0x0000000000295000-memory.dmp

        Filesize

        84KB

      • memory/2668-40-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/2828-44-0x0000000000F00000-0x0000000000F06000-memory.dmp

        Filesize

        24KB

      • memory/2828-43-0x0000000000F00000-0x0000000000F06000-memory.dmp

        Filesize

        24KB

      • memory/2828-45-0x00000000000C0000-0x00000000000EF000-memory.dmp

        Filesize

        188KB

      • memory/3028-30-0x0000000000110000-0x0000000000114000-memory.dmp

        Filesize

        16KB