Analysis
-
max time kernel
148s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-08-2024 11:31
General
-
Target
RFQ REF-JTC AJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe
-
Size
1.1MB
-
MD5
471a314fd2f309be7ab062044e12f0de
-
SHA1
c1058e3787505af5a4df68653625158f8c8ac4b2
-
SHA256
5903a6e132492859e71ad0542938af1fe807e0110fdb132725b7e6fbf5e94b5e
-
SHA512
f12355bcb0c732dcb1f70abae4de91210cbbb8711884b2593048cf5edee0d08a2db64eeec8f8f127ad33e58eeeab6b9eeb577478c037efdedc0b3a0051994fef
-
SSDEEP
24576:qqDEvCTbMWu7rQYlBQcBiT6rprG8aWnmfArkK/yaFuR6i:qTvC/MTQYxsWR7aW/rk9auQ
Malware Config
Extracted
formbook
4.1
pt46
twinportslocal.com
rovor.store
98169.club
mdywl.com
jrd3s.rest
aston1717.top
floridawoodworkingmachinery.com
17tk555t.com
ankitsho.shop
seclameh.com
realrecordlabel.com
trenchonbirmingham.com
af28.top
rtp1kenzototo.com
theselflovesite.com
promotegetpaid.info
strategiclogisticsagency.com
learneracademy.net
per-watch.com
betbox2341.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ REF-JTC AJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe"C:\Users\Admin\AppData\Local\Temp\RFQ REF-JTC AJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\RFQ REF-JTC AJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
80KB
-
Filesize
188KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
188KB