Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
- submitted
01/08/2024, 08:27
General
- Target MalwareBazaar.exe
- Size 653KB
- Sample240801-kclffa1eln
- SHA256 a8af52f378b0d8cc71513411d4af5c383147c03064981084c63125b3f57b7f6a
Malware Config
Extracted
-
formbook
-
4.1
-
de94
-
way2future.net
-
worldnewsdailys.online
-
rendamaisbr.com
-
s485.icu
-
vcxwpo.xyz
-
imagivilleartists.com
-
herbatyorganics.com
-
xn--80ado1abokv5d.xn--p1acf
-
invigoratewell.com
-
especialistaleitura.online
-
pkrstg.com
-
performacaretechnical.com
-
dreamgame55.net
-
hkitgugx.xyz
-
istanlikbilgiler.click
-
slotter99j.vip
-
exploringtheoutdoors.net
-
triberoots.com
-
energiaslotsbet.com
-
dkforcm.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 5 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2600-20-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2600-17-0x0000000000D80000-0x0000000000D94000-memory.dmp
memory/2600-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2600-14-0x0000000000EC0000-0x000000000120A000-memory.dmp
memory/2600-16-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2600-21-0x0000000002C40000-0x0000000002C54000-memory.dmp
memory/3516-35-0x0000000008D90000-0x0000000008EA1000-memory.dmp
memory/3516-33-0x00000000031C0000-0x00000000032E9000-memory.dmp
memory/3516-22-0x0000000008D90000-0x0000000008EA1000-memory.dmp
memory/3516-18-0x00000000031C0000-0x00000000032E9000-memory.dmp
memory/3516-34-0x0000000008EB0000-0x000000000902C000-memory.dmp
memory/3516-37-0x0000000008EB0000-0x000000000902C000-memory.dmp
memory/3516-39-0x0000000008EB0000-0x000000000902C000-memory.dmp
memory/4444-29-0x00000000025E0000-0x000000000292A000-memory.dmp
memory/4444-31-0x0000000002530000-0x00000000025C3000-memory.dmp
memory/4444-30-0x0000000000550000-0x000000000057F000-memory.dmp
memory/4444-28-0x0000000000550000-0x000000000057F000-memory.dmp
memory/4444-25-0x00000000003E0000-0x00000000003F2000-memory.dmp
memory/4444-27-0x00000000003E0000-0x00000000003F2000-memory.dmp
memory/4444-23-0x00000000003E0000-0x00000000003F2000-memory.dmp
memory/4712-6-0x00000000058B0000-0x00000000058C2000-memory.dmp
memory/4712-7-0x0000000006480000-0x000000000648A000-memory.dmp
memory/4712-8-0x0000000006490000-0x000000000649E000-memory.dmp
memory/4712-9-0x00000000064B0000-0x0000000006526000-memory.dmp
memory/4712-0-0x00000000751FE000-0x00000000751FF000-memory.dmp
memory/4712-10-0x0000000008CD0000-0x0000000008D6C000-memory.dmp
memory/4712-13-0x00000000751F0000-0x00000000759A0000-memory.dmp
memory/4712-5-0x0000000005340000-0x000000000534A000-memory.dmp
memory/4712-4-0x00000000751F0000-0x00000000759A0000-memory.dmp
memory/4712-3-0x0000000005260000-0x00000000052F2000-memory.dmp
memory/4712-2-0x00000000058C0000-0x0000000005E64000-memory.dmp
memory/4712-1-0x00000000007E0000-0x000000000088A000-memory.dmp