Analysis

  • max time kernel
    145s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    05-09-2024 11:48

General

  • Target

    SyncTextReader.exe

  • Size

    1.1MB

  • MD5

    3a1133a31a67b64ec6165ac328098fdf

  • SHA1

    43c43d1025925785a23ec4b160dfd566135266ca

  • SHA256

    5f8719f381c3dbe465082297c7ce0d2af2954503f737592f19313ac19f9cd294

  • SHA512

    4014477c4f2ab52fd54747891d14e5817ee7090fc2716c1837284f9887b67c58f697278c22a40c4ff30d9d40d16b0e43b907a2927272152b68b6fd4e4bd1db37

  • SSDEEP

    24576:bU1zwrxR4lWzWzm1ejk7ZDsLCoFCS4/d8:40R4lEWzm1e47MCogH/K

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

j7e

Decoy

cefuoficial.com

luxmusicclub.com

getridofmyed.xyz

sports-plaza.com

peteropsomer.com

kemendi.com

divinciresolve.com

readtogrowup.com

hidex-corp.com

aladininternational.com

snesait.art

ezzpick.net

saveashow.com

eazyprintsplus.com

usadatesclub.com

rafaelraf.com

themiamadison.com

regarta.com

aiocitys.net

ahorn-invest.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 2 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\SyncTextReader.exe
      "C:\Users\Admin\AppData\Local\Temp\SyncTextReader.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NyHwxWSaYDxx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp338E.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:324
      • C:\Users\Admin\AppData\Local\Temp\SyncTextReader.exe
        "C:\Users\Admin\AppData\Local\Temp\SyncTextReader.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1736
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\SysWOW64\control.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1260
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\SyncTextReader.exe"
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp338E.tmp

    Filesize

    1KB

    MD5

    9adf056ffa7961a3b4203ed9de1dd7ca

    SHA1

    397c9124e1cc9b4953d3b2a940ab40083e44e251

    SHA256

    ad71241f6c9b284aa476911d386cfb7f9b9ebad0d265fe1b3d1bf8413eabe1cd

    SHA512

    8f5eb9f1f6bace21eb1b2439d5e64b6e53dab700864d3dfb76422fff9daace29d0d62d122361b38604c7798030d6946e1071e212e6d251b45e148428204ff15a

  • memory/1180-23-0x0000000005650000-0x00000000057AE000-memory.dmp

    Filesize

    1.4MB

  • memory/1180-26-0x0000000005650000-0x00000000057AE000-memory.dmp

    Filesize

    1.4MB

  • memory/1260-24-0x00000000002D0000-0x00000000002EF000-memory.dmp

    Filesize

    124KB

  • memory/1260-25-0x00000000002D0000-0x00000000002EF000-memory.dmp

    Filesize

    124KB

  • memory/1736-21-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1736-22-0x0000000000140000-0x0000000000154000-memory.dmp

    Filesize

    80KB

  • memory/1736-18-0x00000000008E0000-0x0000000000BE3000-memory.dmp

    Filesize

    3.0MB

  • memory/1736-17-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1736-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1736-13-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1736-11-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2412-4-0x0000000074EB0000-0x000000007545B000-memory.dmp

    Filesize

    5.7MB

  • memory/2412-19-0x0000000074EB0000-0x000000007545B000-memory.dmp

    Filesize

    5.7MB

  • memory/2412-5-0x0000000074EB0000-0x000000007545B000-memory.dmp

    Filesize

    5.7MB

  • memory/2412-0-0x0000000074EB1000-0x0000000074EB2000-memory.dmp

    Filesize

    4KB

  • memory/2412-3-0x0000000074EB0000-0x000000007545B000-memory.dmp

    Filesize

    5.7MB

  • memory/2412-2-0x0000000074EB0000-0x000000007545B000-memory.dmp

    Filesize

    5.7MB

  • memory/2412-1-0x0000000074EB0000-0x000000007545B000-memory.dmp

    Filesize

    5.7MB