Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
18/07/2024, 07:02
General
- Target MalwareBazaar.exe
- Size 675KB
- Sample240718-httr2a1dmg
- SHA256 e2fb3e62884d3e10aa6340adc488e37ffb2b15cbfe4842ff4bc7c1c83b908305
Malware Config
Extracted
-
formbook
-
4.1
-
hy08
-
weazc.top
-
servoceimmpajhnuz.info
-
vqemkdhi.xyz
-
wergol.com
-
spa-mk.com
-
rtpsid88.life
-
tatetits.fun
-
raidsa.xyz
-
suojiansuode.net
-
jointhejunction.com
-
wudai.net
-
typeboot.shop
-
mksport-app.com
-
miocloud.ovh
-
taipan77pandan.com
-
wwwhg58a.com
-
khuahamiksai31.pro
-
carpedatumllc.net
-
safebinders.com
-
krx21.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/400-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/400-18-0x0000000000400000-0x000000000042F000-memory.dmp
memory/400-19-0x00000000018E0000-0x00000000018F5000-memory.dmp
memory/400-16-0x00000000019C0000-0x0000000001D0A000-memory.dmp
memory/832-24-0x00000000004F0000-0x000000000051F000-memory.dmp
memory/832-23-0x0000000000D00000-0x0000000000D1F000-memory.dmp
memory/832-21-0x0000000000D00000-0x0000000000D1F000-memory.dmp
memory/2116-12-0x0000000006890000-0x000000000692C000-memory.dmp
memory/2116-6-0x0000000005B50000-0x0000000005EA4000-memory.dmp
memory/2116-9-0x0000000006D60000-0x0000000006D7A000-memory.dmp
memory/2116-10-0x00000000065B0000-0x00000000065BE000-memory.dmp
memory/2116-11-0x00000000065D0000-0x0000000006646000-memory.dmp
memory/2116-0-0x000000007473E000-0x000000007473F000-memory.dmp
memory/2116-7-0x0000000005570000-0x0000000005582000-memory.dmp
memory/2116-15-0x0000000074730000-0x0000000074EE0000-memory.dmp
memory/2116-5-0x0000000074730000-0x0000000074EE0000-memory.dmp
memory/2116-8-0x0000000006BE0000-0x0000000006C02000-memory.dmp
memory/2116-4-0x0000000004FB0000-0x0000000004FBA000-memory.dmp
memory/2116-1-0x0000000000650000-0x00000000006FE000-memory.dmp
memory/2116-3-0x0000000004FF0000-0x0000000005082000-memory.dmp
memory/2116-2-0x00000000055A0000-0x0000000005B44000-memory.dmp
memory/3392-20-0x00000000082B0000-0x00000000083EA000-memory.dmp
memory/3392-26-0x00000000082B0000-0x00000000083EA000-memory.dmp
memory/3392-28-0x00000000083F0000-0x00000000084FB000-memory.dmp
memory/3392-29-0x00000000083F0000-0x00000000084FB000-memory.dmp
memory/3392-32-0x00000000083F0000-0x00000000084FB000-memory.dmp