Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
- submitted
01/08/2024, 16:06
General
- Target MalwareBazaar.exe
- Size 918KB
- Sample240801-tkc9gashke
- SHA256 2aa8ec244fd85957972c5dc5e2d05f8485e7b4becd16d68e4e0dfe5594ce7272
Malware Config
Extracted
-
formbook
-
4.1
-
na10
-
tetheus.com
-
ventlikeyoumeanit.com
-
tintbliss.com
-
rinabet357.com
-
sapphireboutiqueusa.com
-
abc8bet6.com
-
xzcn3i7jb13cqei.buzz
-
pinktravelsnagpur.com
-
bt365038.com
-
rtpbossujang303.shop
-
osthirmaker.com
-
thelonelyteacup.com
-
rlc2019.com
-
couverture-charpente.com
-
productivagc.com
-
defendercarcare.com
-
abcentixdigital.com
-
petco.ltd
-
oypivh.top
-
micro.guru
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1568-21-0x0000000000D20000-0x0000000000D3F000-memory.dmp
memory/1568-25-0x0000000000720000-0x000000000074F000-memory.dmp
memory/1568-24-0x0000000000D20000-0x0000000000D3F000-memory.dmp
memory/2600-12-0x0000000074820000-0x0000000074FD0000-memory.dmp
memory/2600-15-0x0000000074820000-0x0000000074FD0000-memory.dmp
memory/2600-5-0x0000000074820000-0x0000000074FD0000-memory.dmp
memory/2600-6-0x00000000050D0000-0x0000000005114000-memory.dmp
memory/2600-7-0x0000000005150000-0x000000000515A000-memory.dmp
memory/2600-8-0x0000000074820000-0x0000000074FD0000-memory.dmp
memory/2600-9-0x0000000006930000-0x000000000694A000-memory.dmp
memory/2600-10-0x0000000008F00000-0x0000000008F06000-memory.dmp
memory/2600-11-0x000000007482E000-0x000000007482F000-memory.dmp
memory/2600-0-0x000000007482E000-0x000000007482F000-memory.dmp
memory/2600-1-0x0000000000D80000-0x0000000000E6C000-memory.dmp
memory/2600-4-0x0000000004D70000-0x0000000004E0C000-memory.dmp
memory/2600-2-0x00000000051E0000-0x0000000005784000-memory.dmp
memory/2600-3-0x0000000004CD0000-0x0000000004D62000-memory.dmp
memory/3524-20-0x0000000002B90000-0x0000000002C4B000-memory.dmp
memory/3524-27-0x0000000002B90000-0x0000000002C4B000-memory.dmp
memory/3524-30-0x0000000002C50000-0x0000000002D0D000-memory.dmp
memory/3524-31-0x0000000002C50000-0x0000000002D0D000-memory.dmp
memory/3524-34-0x0000000002C50000-0x0000000002D0D000-memory.dmp
memory/4716-19-0x00000000014F0000-0x0000000001504000-memory.dmp
memory/4716-18-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4716-16-0x0000000001790000-0x0000000001ADA000-memory.dmp
memory/4716-13-0x0000000000400000-0x000000000042F000-memory.dmp