Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
12/09/2024, 19:36
General
- Target BN7qJ4EGbiL2jf9.exe
- Size 654KB
- Sample240912-ya9bda1crc
- SHA256 8d4982f32dffdff70405b3185f7a3e6ca96c596663576ca85c1f8dae9352e3b3
Malware Config
Extracted
-
formbook
-
4.1
-
d16h
-
iki-graphy.online
-
l8z8c.vip
-
1709.asia
-
inematography-course-72246.bond
-
pis3noe2e.sbs
-
wernv.xyz
-
ovepepe.xyz
-
ama-online.world
-
ookmouse.fun
-
harkclothingdesigns.xyz
-
bbvvjuiqew.bond
-
sed-cars-93620.bond
-
esgateeganhe.shop
-
cekmeledak.info
-
ebulahorizon.buzz
-
peakers-92991.bond
-
essislotgoal16.top
-
hafi.biz
-
ichunyang.club
-
lrica.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BN7qJ4EGbiL2jf9.exe"C:\Users\Admin\AppData\Local\Temp\BN7qJ4EGbiL2jf9.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BN7qJ4EGbiL2jf9.exe"C:\Users\Admin\AppData\Local\Temp\BN7qJ4EGbiL2jf9.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\BN7qJ4EGbiL2jf9.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2520-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2520-17-0x00000000012F0000-0x0000000001304000-memory.dmp
memory/2520-16-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2520-14-0x0000000001350000-0x000000000169A000-memory.dmp
memory/3400-26-0x0000000008B30000-0x0000000008CA7000-memory.dmp
memory/3400-24-0x0000000008B30000-0x0000000008CA7000-memory.dmp
memory/3400-22-0x00000000089D0000-0x0000000008B24000-memory.dmp
memory/3400-18-0x00000000089D0000-0x0000000008B24000-memory.dmp
memory/4016-5-0x00000000748E0000-0x0000000075090000-memory.dmp
memory/4016-0-0x00000000748EE000-0x00000000748EF000-memory.dmp
memory/4016-10-0x000000000A130000-0x000000000A1CC000-memory.dmp
memory/4016-8-0x00000000748E0000-0x0000000075090000-memory.dmp
memory/4016-13-0x00000000748E0000-0x0000000075090000-memory.dmp
memory/4016-7-0x00000000748EE000-0x00000000748EF000-memory.dmp
memory/4016-6-0x0000000007A40000-0x0000000007A50000-memory.dmp
memory/4016-9-0x00000000063D0000-0x0000000006446000-memory.dmp
memory/4016-4-0x0000000002A50000-0x0000000002A5A000-memory.dmp
memory/4016-1-0x00000000003F0000-0x000000000049A000-memory.dmp
memory/4016-2-0x0000000005460000-0x0000000005A04000-memory.dmp
memory/4016-3-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/4524-21-0x0000000000E30000-0x0000000000E5F000-memory.dmp
memory/4524-19-0x0000000000E00000-0x0000000000E27000-memory.dmp
memory/4524-20-0x0000000000E00000-0x0000000000E27000-memory.dmp