Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    08-08-2024 06:36

General

  • Target

    d4016be0cb5e22645898c576c8e078b2db3dabd8060f5920e710cce59fa81fe9.exe

  • Size

    768KB

  • MD5

    05ef7ade99c5e2d204f44a83481f98df

  • SHA1

    2a055a83e04b1918072c21dbc992caffce466b5e

  • SHA256

    d4016be0cb5e22645898c576c8e078b2db3dabd8060f5920e710cce59fa81fe9

  • SHA512

    34a6d2cc7ca2da3b30056ceb0541bd5382aede8627e9a1ecf42e0dcac38b12031bbf8a8ccf7532c7b33798f4270353db90ea78ae89acb959af85423d223c3d22

  • SSDEEP

    12288:1IWiyHwQn+eSI+i1PV5gx/aJtWBQo4yK/7HV3aQCFBQR7MMUITRPoqyrAg2XgTPa:mzyHEeSIBb/WJ4dj13aUzUW2hV2wTPdy

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy08

Decoy

weazc.top

servoceimmpajhnuz.info

vqemkdhi.xyz

wergol.com

spa-mk.com

rtpsid88.life

tatetits.fun

raidsa.xyz

suojiansuode.net

jointhejunction.com

wudai.net

typeboot.shop

mksport-app.com

miocloud.ovh

taipan77pandan.com

wwwhg58a.com

khuahamiksai31.pro

carpedatumllc.net

safebinders.com

krx21.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4016be0cb5e22645898c576c8e078b2db3dabd8060f5920e710cce59fa81fe9.exe
    "C:\Users\Admin\AppData\Local\Temp\d4016be0cb5e22645898c576c8e078b2db3dabd8060f5920e710cce59fa81fe9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\glzojWKniaYcql.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2180
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\glzojWKniaYcql" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD394.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2292
    • C:\Users\Admin\AppData\Local\Temp\d4016be0cb5e22645898c576c8e078b2db3dabd8060f5920e710cce59fa81fe9.exe
      "C:\Users\Admin\AppData\Local\Temp\d4016be0cb5e22645898c576c8e078b2db3dabd8060f5920e710cce59fa81fe9.exe"
      2⤵
        PID:2820
      • C:\Users\Admin\AppData\Local\Temp\d4016be0cb5e22645898c576c8e078b2db3dabd8060f5920e710cce59fa81fe9.exe
        "C:\Users\Admin\AppData\Local\Temp\d4016be0cb5e22645898c576c8e078b2db3dabd8060f5920e710cce59fa81fe9.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2788

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpD394.tmp

      Filesize

      1KB

      MD5

      f3f22530cf89c7b0cd71d453c5a4f790

      SHA1

      21ac0b0279b6d49eb910a5098feebae1580f96ab

      SHA256

      db58411fe74366fa4df94442a3908a0aa4d1547cb04454bd878c5505f8ee3bbf

      SHA512

      354d9bd683cd14680c30274f570aa67b8200850a7cacd52e95328719b772e46fcc88033a128f653df03569c40a134681399823048f4f6d39e29d2e8e6b4241cd

    • memory/2316-6-0x0000000000600000-0x0000000000616000-memory.dmp

      Filesize

      88KB

    • memory/2316-2-0x0000000004980000-0x0000000004A1A000-memory.dmp

      Filesize

      616KB

    • memory/2316-3-0x0000000073EC0000-0x00000000745AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2316-4-0x0000000000500000-0x000000000051A000-memory.dmp

      Filesize

      104KB

    • memory/2316-5-0x00000000005F0000-0x00000000005FE000-memory.dmp

      Filesize

      56KB

    • memory/2316-0-0x0000000073ECE000-0x0000000073ECF000-memory.dmp

      Filesize

      4KB

    • memory/2316-7-0x0000000004E10000-0x0000000004E86000-memory.dmp

      Filesize

      472KB

    • memory/2316-1-0x0000000000A00000-0x0000000000AC6000-memory.dmp

      Filesize

      792KB

    • memory/2316-19-0x0000000073EC0000-0x00000000745AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2788-18-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2788-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2788-15-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2788-13-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.