Analysis

  • max time kernel
    94s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-09-2024 01:05

General

  • Target

    1d5c6a9f196dc3d9f2e483744d7b872f01a96b8320ce3ffdc66b66542cb7a899.exe

  • Size

    588KB

  • MD5

    cc0a03d130918f8d5c8d6b46833967b1

  • SHA1

    35edc921398ba4d5689e5bcced856c0f2d561c70

  • SHA256

    1d5c6a9f196dc3d9f2e483744d7b872f01a96b8320ce3ffdc66b66542cb7a899

  • SHA512

    78316ff0363c7cc9cc5dedab407b9dc3394c27eb15fba416a04996f117b473814a808e6847c4c2b779ceaa66f22d843b13b36530e969c675edc1222d76c99873

  • SSDEEP

    12288:2aTdEMYimT/D37YF6oRZyWwJAA9X8gnd7/OKImE3hoTSO3XHL:CMo30pZxwJAA9X8Y/ohoTx37

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m10i

Decoy

rmani.today

ifebork.xyz

randovation.net

itchen-remodeling-65686.bond

himu.world

reverie.net

9038.top

rowahome.live

obility-scooters-63189.bond

iangchunqiu.top

yhd.fun

eniorsforseniors.biz

z9zs2.shop

kkjinni.buzz

22av373vu.autos

allnyy.fun

qst.digital

rcap.info

745.top

earfulabjectshirkwashclothe.cfd

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d5c6a9f196dc3d9f2e483744d7b872f01a96b8320ce3ffdc66b66542cb7a899.exe
    "C:\Users\Admin\AppData\Local\Temp\1d5c6a9f196dc3d9f2e483744d7b872f01a96b8320ce3ffdc66b66542cb7a899.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1d5c6a9f196dc3d9f2e483744d7b872f01a96b8320ce3ffdc66b66542cb7a899.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2552
    • C:\Users\Admin\AppData\Local\Temp\1d5c6a9f196dc3d9f2e483744d7b872f01a96b8320ce3ffdc66b66542cb7a899.exe
      "C:\Users\Admin\AppData\Local\Temp\1d5c6a9f196dc3d9f2e483744d7b872f01a96b8320ce3ffdc66b66542cb7a899.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4904

Network

  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    138.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    138.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    138.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    138.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    140 B
    144 B
    2
    1

    DNS Request

    86.23.85.13.in-addr.arpa

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bpwxa4ou.adv.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2456-6-0x0000000005400000-0x0000000005410000-memory.dmp

    Filesize

    64KB

  • memory/2456-2-0x0000000005810000-0x0000000005DB4000-memory.dmp

    Filesize

    5.6MB

  • memory/2456-3-0x0000000005140000-0x00000000051D2000-memory.dmp

    Filesize

    584KB

  • memory/2456-4-0x0000000005210000-0x000000000521A000-memory.dmp

    Filesize

    40KB

  • memory/2456-5-0x0000000074AD0000-0x0000000075280000-memory.dmp

    Filesize

    7.7MB

  • memory/2456-0-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

    Filesize

    4KB

  • memory/2456-7-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

    Filesize

    4KB

  • memory/2456-8-0x0000000074AD0000-0x0000000075280000-memory.dmp

    Filesize

    7.7MB

  • memory/2456-9-0x0000000006630000-0x00000000066A6000-memory.dmp

    Filesize

    472KB

  • memory/2456-10-0x0000000008DF0000-0x0000000008E8C000-memory.dmp

    Filesize

    624KB

  • memory/2456-1-0x00000000006E0000-0x000000000077A000-memory.dmp

    Filesize

    616KB

  • memory/2456-13-0x0000000074AD0000-0x0000000075280000-memory.dmp

    Filesize

    7.7MB

  • memory/2552-21-0x0000000004D50000-0x0000000004DB6000-memory.dmp

    Filesize

    408KB

  • memory/2552-36-0x0000000074B70000-0x0000000075320000-memory.dmp

    Filesize

    7.7MB

  • memory/2552-16-0x0000000002470000-0x00000000024A6000-memory.dmp

    Filesize

    216KB

  • memory/2552-18-0x0000000004F60000-0x0000000005588000-memory.dmp

    Filesize

    6.2MB

  • memory/2552-17-0x0000000074B70000-0x0000000075320000-memory.dmp

    Filesize

    7.7MB

  • memory/2552-20-0x0000000074B70000-0x0000000075320000-memory.dmp

    Filesize

    7.7MB

  • memory/2552-22-0x0000000004E30000-0x0000000004E96000-memory.dmp

    Filesize

    408KB

  • memory/2552-62-0x0000000074B70000-0x0000000075320000-memory.dmp

    Filesize

    7.7MB

  • memory/2552-19-0x0000000004CB0000-0x0000000004CD2000-memory.dmp

    Filesize

    136KB

  • memory/2552-59-0x00000000073D0000-0x00000000073D8000-memory.dmp

    Filesize

    32KB

  • memory/2552-32-0x0000000005790000-0x0000000005AE4000-memory.dmp

    Filesize

    3.3MB

  • memory/2552-33-0x0000000005D70000-0x0000000005D8E000-memory.dmp

    Filesize

    120KB

  • memory/2552-34-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

    Filesize

    304KB

  • memory/2552-37-0x0000000070990000-0x00000000709DC000-memory.dmp

    Filesize

    304KB

  • memory/2552-47-0x0000000006D70000-0x0000000006D8E000-memory.dmp

    Filesize

    120KB

  • memory/2552-15-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

    Filesize

    4KB

  • memory/2552-48-0x0000000074B70000-0x0000000075320000-memory.dmp

    Filesize

    7.7MB

  • memory/2552-49-0x0000000006D90000-0x0000000006E33000-memory.dmp

    Filesize

    652KB

  • memory/2552-35-0x0000000006350000-0x0000000006382000-memory.dmp

    Filesize

    200KB

  • memory/2552-50-0x0000000074B70000-0x0000000075320000-memory.dmp

    Filesize

    7.7MB

  • memory/2552-52-0x00000000070B0000-0x00000000070CA000-memory.dmp

    Filesize

    104KB

  • memory/2552-51-0x00000000076F0000-0x0000000007D6A000-memory.dmp

    Filesize

    6.5MB

  • memory/2552-53-0x0000000007120000-0x000000000712A000-memory.dmp

    Filesize

    40KB

  • memory/2552-54-0x0000000007330000-0x00000000073C6000-memory.dmp

    Filesize

    600KB

  • memory/2552-55-0x00000000072B0000-0x00000000072C1000-memory.dmp

    Filesize

    68KB

  • memory/2552-56-0x00000000072E0000-0x00000000072EE000-memory.dmp

    Filesize

    56KB

  • memory/2552-57-0x00000000072F0000-0x0000000007304000-memory.dmp

    Filesize

    80KB

  • memory/2552-58-0x00000000073F0000-0x000000000740A000-memory.dmp

    Filesize

    104KB

  • memory/4904-11-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/4904-14-0x00000000011E0000-0x000000000152A000-memory.dmp

    Filesize

    3.3MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.