Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-07-2024 09:51

General

  • Target

    PO1511-pdf.exe

  • Size

    134KB

  • MD5

    7f723f9e10de5dd1ce6d4e6bde89abe4

  • SHA1

    555e9af7d45b4436709150c474c28908225132f5

  • SHA256

    dd36a21b3f11b6142a898ce80d046abf5f8e0b62fa112957db619c865272ce20

  • SHA512

    ccce6e52dca4c11a8de88118b92b477c4f12f035557d6fe132d95e663d67721c76999cff688baeb349e494bfc89d49d636d8ff25207ed1c232f3b2f68508bb7e

  • SSDEEP

    3072:/kHnTc+neY+r6MVpHQhIB2E+kgaJysLTVm1AYUb:/kHTi3US/

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mu94

Decoy

thenextamendment.net

automatiza.xyz

psikologhazelgungor.com

90857.net

robertoblondetrealtor.site

rv0awy.rest

74657.ooo

adigidea.com

world-healing.online

health4world.com

shyan.fun

anviltotable.com

vinger.online

juizltd.com

twmk.asia

cakescrushbyruby.com

listxtreme.com

00050026.xyz

finessedesignhouse.com

jsmm-27.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Users\Admin\AppData\Local\Temp\PO1511-pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\PO1511-pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:404
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" NoLabel
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4832
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:716
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
          PID:4124

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/404-10-0x00007FFE23C20000-0x00007FFE246E1000-memory.dmp

      Filesize

      10.8MB

    • memory/404-2-0x00007FFE23C20000-0x00007FFE246E1000-memory.dmp

      Filesize

      10.8MB

    • memory/404-3-0x0000000002290000-0x000000000229A000-memory.dmp

      Filesize

      40KB

    • memory/404-0-0x00007FFE23C23000-0x00007FFE23C25000-memory.dmp

      Filesize

      8KB

    • memory/404-1-0x0000000000150000-0x0000000000176000-memory.dmp

      Filesize

      152KB

    • memory/716-18-0x0000000000D20000-0x0000000000D4F000-memory.dmp

      Filesize

      188KB

    • memory/716-17-0x0000000000390000-0x00000000003A4000-memory.dmp

      Filesize

      80KB

    • memory/716-15-0x0000000000390000-0x00000000003A4000-memory.dmp

      Filesize

      80KB

    • memory/3372-9-0x0000000002D20000-0x0000000002E7E000-memory.dmp

      Filesize

      1.4MB

    • memory/3372-25-0x0000000007350000-0x0000000007443000-memory.dmp

      Filesize

      972KB

    • memory/3372-21-0x0000000002B30000-0x0000000002BF4000-memory.dmp

      Filesize

      784KB

    • memory/3372-20-0x0000000002D20000-0x0000000002E7E000-memory.dmp

      Filesize

      1.4MB

    • memory/3372-14-0x0000000002B30000-0x0000000002BF4000-memory.dmp

      Filesize

      784KB

    • memory/3372-23-0x0000000007350000-0x0000000007443000-memory.dmp

      Filesize

      972KB

    • memory/3372-28-0x0000000007350000-0x0000000007443000-memory.dmp

      Filesize

      972KB

    • memory/4832-5-0x00000000010C0000-0x000000000140A000-memory.dmp

      Filesize

      3.3MB

    • memory/4832-13-0x00000000015E0000-0x00000000015F5000-memory.dmp

      Filesize

      84KB

    • memory/4832-12-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/4832-8-0x0000000001030000-0x0000000001045000-memory.dmp

      Filesize

      84KB

    • memory/4832-7-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/4832-4-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB