Analysis
-
max time kernel
146s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27-08-2024 08:50
General
-
Target
New Al Maktoum International Airport Enquiry Ref #2401249.exe
-
Size
1.1MB
-
MD5
621c253a4d715e3af16fe8be2fdd8cb1
-
SHA1
68ce09cc59887c7f9649f22e6688028957d6c55e
-
SHA256
007c997b49ac0889e71757762c82432a975a273eda4c871acec3c0823c6ea530
-
SHA512
56616c4175b53f6b00591e7aa5d32146fb168de7a22501c9fd784a0ccc5d403b5b920f01f3545cceab9ea0dd0cc5df992d339bed6a838e930094f35782bc4fa6
-
SSDEEP
24576:TAHnh+eWsN3skA4RV1Hom2KXMmHaIxs0ZkXe9VHdA5:eh+ZkldoPK8YaIxIe9O
Malware Config
Extracted
formbook
4.1
pt46
twinportslocal.com
rovor.store
98169.club
mdywl.com
jrd3s.rest
aston1717.top
floridawoodworkingmachinery.com
17tk555t.com
ankitsho.shop
seclameh.com
realrecordlabel.com
trenchonbirmingham.com
af28.top
rtp1kenzototo.com
theselflovesite.com
promotegetpaid.info
strategiclogisticsagency.com
learneracademy.net
per-watch.com
betbox2341.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\New Al Maktoum International Airport Enquiry Ref #2401249.exe"C:\Users\Admin\AppData\Local\Temp\New Al Maktoum International Airport Enquiry Ref #2401249.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\New Al Maktoum International Airport Enquiry Ref #2401249.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
188KB
-
Filesize
16KB
-
Filesize
1.5MB
-
Filesize
848KB
-
Filesize
848KB