Analysis
- max time kernel
147s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
25/09/2024, 01:57
General
- Target www.exe
- Size 1.0MB
- Sample240925-cdkljayajr
- SHA256 3218d9e3413de3fc262447ccddd5f9f458c82abdb96943e830dfc3ebeb1a1de5
Malware Config
Extracted
-
formbook
-
4.1
-
e62s
-
ellinksa.shop
-
uckyspinph.xyz
-
owdark.net
-
arriage-therapy-72241.bond
-
w7ijko4rv4p97b.top
-
heirbuzzwords.buzz
-
aspart.shop
-
ctivemail5-kagoya-com.info
-
shacertification9.shop
-
zitcd65k3.buzz
-
llkosoi.info
-
ru8.info
-
rhgtrdjdjykyetrdjftd.buzz
-
yschoollist.kiwi
-
oftfolio.online
-
rograma-de-almacen-2.online
-
oudoarms.top
-
mwquas.xyz
-
orjagaucha.website
-
nlinechat-mh.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Formbook payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\www.exe"C:\Users\Admin\AppData\Local\Temp\www.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1736-1093-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1736-1098-0x00000000014A0000-0x00000000014B5000-memory.dmp
memory/1736-1097-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1736-1096-0x0000000001610000-0x000000000195A000-memory.dmp
memory/3172-1102-0x0000000000100000-0x0000000000119000-memory.dmp
memory/3452-63-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-1087-0x0000000074CC0000-0x0000000075470000-memory.dmp
memory/3452-2-0x0000000005280000-0x000000000537E000-memory.dmp
memory/3452-8-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-3-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-31-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-61-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-37-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-29-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-27-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-25-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-23-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-55-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-17-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-15-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-13-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-10-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-11-0x0000000074CC0000-0x0000000075470000-memory.dmp
memory/3452-22-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-6-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-4-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-65-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-67-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-0-0x0000000074CCE000-0x0000000074CCF000-memory.dmp
memory/3452-1-0x00000000004E0000-0x00000000005E6000-memory.dmp
memory/3452-59-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-19-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-53-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-51-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-49-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-47-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-45-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-43-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-41-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-39-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-35-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-33-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-1078-0x0000000074CC0000-0x0000000075470000-memory.dmp
memory/3452-1079-0x0000000005A40000-0x0000000005AB8000-memory.dmp
memory/3452-1080-0x00000000055D0000-0x000000000561C000-memory.dmp
memory/3452-1081-0x0000000005B80000-0x0000000005C12000-memory.dmp
memory/3452-1082-0x0000000005C20000-0x0000000005C86000-memory.dmp
memory/3452-1086-0x0000000074CC0000-0x0000000075470000-memory.dmp
memory/3452-57-0x0000000005280000-0x0000000005378000-memory.dmp
memory/3452-1088-0x0000000074CC0000-0x0000000075470000-memory.dmp
memory/3452-1089-0x00000000064F0000-0x0000000006A94000-memory.dmp
memory/3452-1090-0x0000000006080000-0x00000000060D4000-memory.dmp
memory/3452-1094-0x0000000074CC0000-0x0000000075470000-memory.dmp
memory/3484-1099-0x00000000083F0000-0x000000000855D000-memory.dmp
memory/3484-1104-0x00000000083F0000-0x000000000855D000-memory.dmp
memory/3484-1107-0x0000000002F80000-0x0000000003032000-memory.dmp
memory/3484-1110-0x0000000002F80000-0x0000000003032000-memory.dmp