Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 21:20

General

  • Target

    6a1ff3a9d7b6cbba06c46cbe04433eacbffb7f62d20bdcb38ad7d50fc6d6fab6.exe

  • Size

    1.1MB

  • MD5

    853411ef6f70669a8333b503c2709c15

  • SHA1

    da98ef73c0f864862a93482ce19f86ceff91ac1b

  • SHA256

    6a1ff3a9d7b6cbba06c46cbe04433eacbffb7f62d20bdcb38ad7d50fc6d6fab6

  • SHA512

    e9863dfe2b40f8284843c725161b5c0f63fd3559a4fe69398deb3e4d1a87e9fa9d121e63ea1787151d703ee1f87fb202b8fd3fd5ae68e70556240a676033b4ea

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCErHiF0WHKgUytHxfMuxANhAQpAu:7JZoQrbTFZY1iaCyHq0eUoHRxAXAu

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

k94g

Decoy

nstandgoz.xyz

dhd-treatment-37310.bond

13s-braces-us-ze.fun

umdona.shop

96ph803ql.bond

kka9max.net

corporate-10.xyz

edicalassistance869840.online

lobalresources-bh.xyz

3145978.xyz

ovdaawebsite.online

etting-thailand.net

icloud.xyz

poxk.shop

25ks-ls72510.cyou

women.info

iwyrfbfvhv9.asia

luratu.xyz

ffordable-power-charger.today

edanuryilmaz.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Users\Admin\AppData\Local\Temp\6a1ff3a9d7b6cbba06c46cbe04433eacbffb7f62d20bdcb38ad7d50fc6d6fab6.exe
      "C:\Users\Admin\AppData\Local\Temp\6a1ff3a9d7b6cbba06c46cbe04433eacbffb7f62d20bdcb38ad7d50fc6d6fab6.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1016
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\6a1ff3a9d7b6cbba06c46cbe04433eacbffb7f62d20bdcb38ad7d50fc6d6fab6.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1748
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:1212
      • C:\Windows\SysWOW64\autochk.exe
        "C:\Windows\SysWOW64\autochk.exe"
        2⤵
          PID:5004
        • C:\Windows\SysWOW64\autochk.exe
          "C:\Windows\SysWOW64\autochk.exe"
          2⤵
            PID:4528
          • C:\Windows\SysWOW64\autochk.exe
            "C:\Windows\SysWOW64\autochk.exe"
            2⤵
              PID:5100
            • C:\Windows\SysWOW64\autochk.exe
              "C:\Windows\SysWOW64\autochk.exe"
              2⤵
                PID:3300
              • C:\Windows\SysWOW64\autochk.exe
                "C:\Windows\SysWOW64\autochk.exe"
                2⤵
                  PID:1228
                • C:\Windows\SysWOW64\cscript.exe
                  "C:\Windows\SysWOW64\cscript.exe"
                  2⤵
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4812
                  • C:\Windows\SysWOW64\cmd.exe
                    /c del "C:\Windows\SysWOW64\svchost.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2540

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1016-2-0x00000000043B0000-0x00000000047B0000-memory.dmp

                Filesize

                4.0MB

              • memory/1748-3-0x0000000000400000-0x000000000042F000-memory.dmp

                Filesize

                188KB

              • memory/1748-4-0x0000000001400000-0x000000000174A000-memory.dmp

                Filesize

                3.3MB

              • memory/1748-7-0x0000000001380000-0x0000000001394000-memory.dmp

                Filesize

                80KB

              • memory/1748-6-0x0000000000400000-0x000000000042F000-memory.dmp

                Filesize

                188KB

              • memory/3484-12-0x00000000028B0000-0x000000000298A000-memory.dmp

                Filesize

                872KB

              • memory/3484-8-0x00000000028B0000-0x000000000298A000-memory.dmp

                Filesize

                872KB

              • memory/3484-16-0x00000000077F0000-0x00000000078DE000-memory.dmp

                Filesize

                952KB

              • memory/3484-17-0x00000000077F0000-0x00000000078DE000-memory.dmp

                Filesize

                952KB

              • memory/3484-19-0x00000000077F0000-0x00000000078DE000-memory.dmp

                Filesize

                952KB

              • memory/4812-10-0x00000000007B0000-0x00000000007D7000-memory.dmp

                Filesize

                156KB

              • memory/4812-9-0x00000000007B0000-0x00000000007D7000-memory.dmp

                Filesize

                156KB

              • memory/4812-11-0x0000000001380000-0x00000000013AF000-memory.dmp

                Filesize

                188KB