Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2024 08:23

General

  • Target

    48de7633a9738c2392d6a449f59fcbcb.exe

  • Size

    1.6MB

  • MD5

    48de7633a9738c2392d6a449f59fcbcb

  • SHA1

    f30905ce8f900e86f67d27bda53e1e8e42885356

  • SHA256

    d722071e87692ef2f7b94aa22e2b5153219dea78de81315b8fdaf18a3dc4cf6a

  • SHA512

    e8976d81a2d0039a90ccb5ddfc5dc86e541b59625a0f3901e6e3a422e1873290f8bcc936fa27b53b56411c9fc98bb7eac90f58c9b31d2d2c6750a40dece0bea2

  • SSDEEP

    49152:IAodtaG9kS2U84B+FLan9k5TRM9zlFVjrW22:Y/B1x2

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kmge

Decoy

jia0752d.com

cq0jt.sbs

whimsicalweddingrentals.com

meetsex-here.life

hhe-crv220.com

bedbillionaire.com

soycmo.com

mrawkward.xyz

11ramshornroad.com

motoyonaturals.com

thischicloves.com

gacorbet.pro

ihsanid.com

pancaketurner.com

santanarstore.com

cr3dtv.com

negotools.com

landfillequip.com

sejasuapropriachefe.com

diamant-verkopen.store

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Formbook payload 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\48de7633a9738c2392d6a449f59fcbcb.exe
      "C:\Users\Admin\AppData\Local\Temp\48de7633a9738c2392d6a449f59fcbcb.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2744
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
          PID:2204
        • C:\Windows\regedit.exe
          "C:\Windows\regedit.exe"
          3⤵
          • Runs regedit.exe
          PID:2632
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
          3⤵
            PID:1316
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
            3⤵
              PID:2660
            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
              3⤵
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2708
              • C:\Windows\SysWOW64\colorcpl.exe
                "C:\Windows\SysWOW64\colorcpl.exe"
                4⤵
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1840
                • C:\Program Files\Mozilla Firefox\Firefox.exe
                  "C:\Program Files\Mozilla Firefox\Firefox.exe"
                  5⤵
                    PID:264

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logim.jpeg

            Filesize

            67KB

            MD5

            b35f4a2eea6c80ecc9d58c18811a12d4

            SHA1

            55b717e4286df35ca87c8dbd7703b8f395bd45f8

            SHA256

            80d2a7152d3703c702232735c1ac812d8744375dee989928c1f2a51aaf49d513

            SHA512

            7f560d1eeb090f0c9dfbf2a09a96d4aaf62410a781ac2f813297f7e37651916540ec9bd96ed54acca5dda67f210970912547bb35b18956e14878c8dbec3610b7

          • C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logrf.ini

            Filesize

            40B

            MD5

            2f245469795b865bdd1b956c23d7893d

            SHA1

            6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

            SHA256

            1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

            SHA512

            909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

          • C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logri.ini

            Filesize

            40B

            MD5

            d63a82e5d81e02e399090af26db0b9cb

            SHA1

            91d0014c8f54743bba141fd60c9d963f869d76c9

            SHA256

            eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

            SHA512

            38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

          • C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logrv.ini

            Filesize

            40B

            MD5

            ba3b6bc807d4f76794c4b81b09bb9ba5

            SHA1

            24cb89501f0212ff3095ecc0aba97dd563718fb1

            SHA256

            6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507

            SHA512

            ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf

          • memory/1180-20-0x00000000051E0000-0x00000000052D3000-memory.dmp

            Filesize

            972KB

          • memory/1180-34-0x00000000070E0000-0x00000000071AB000-memory.dmp

            Filesize

            812KB

          • memory/1180-32-0x00000000066A0000-0x0000000006777000-memory.dmp

            Filesize

            860KB

          • memory/1180-24-0x00000000051E0000-0x00000000052D3000-memory.dmp

            Filesize

            972KB

          • memory/1180-25-0x00000000066A0000-0x0000000006777000-memory.dmp

            Filesize

            860KB

          • memory/1180-19-0x0000000003AC0000-0x0000000003BC0000-memory.dmp

            Filesize

            1024KB

          • memory/1840-28-0x0000000000080000-0x00000000000AF000-memory.dmp

            Filesize

            188KB

          • memory/1840-26-0x00000000006A0000-0x00000000006B8000-memory.dmp

            Filesize

            96KB

          • memory/1840-27-0x00000000006A0000-0x00000000006B8000-memory.dmp

            Filesize

            96KB

          • memory/2708-22-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2708-15-0x0000000000A50000-0x0000000000D53000-memory.dmp

            Filesize

            3.0MB

          • memory/2708-18-0x0000000000140000-0x0000000000154000-memory.dmp

            Filesize

            80KB

          • memory/2708-17-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2708-14-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2708-23-0x0000000000210000-0x0000000000224000-memory.dmp

            Filesize

            80KB

          • memory/2744-12-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

            Filesize

            9.6MB

          • memory/2744-13-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

            Filesize

            9.6MB

          • memory/2744-4-0x000007FEF5FBE000-0x000007FEF5FBF000-memory.dmp

            Filesize

            4KB

          • memory/2744-6-0x00000000022A0000-0x00000000022A8000-memory.dmp

            Filesize

            32KB

          • memory/2744-8-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

            Filesize

            9.6MB

          • memory/2744-10-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

            Filesize

            9.6MB

          • memory/2744-9-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

            Filesize

            9.6MB

          • memory/2744-7-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

            Filesize

            9.6MB

          • memory/2744-5-0x000000001B800000-0x000000001BAE2000-memory.dmp

            Filesize

            2.9MB