Analysis
- max time kernel
146s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
25/09/2024, 02:11
General
- Target www.exe
- Size 1.0MB
- Sample240925-cmjetssajh
- SHA256 3218d9e3413de3fc262447ccddd5f9f458c82abdb96943e830dfc3ebeb1a1de5
Malware Config
Extracted
-
formbook
-
4.1
-
e62s
-
ellinksa.shop
-
uckyspinph.xyz
-
owdark.net
-
arriage-therapy-72241.bond
-
w7ijko4rv4p97b.top
-
heirbuzzwords.buzz
-
aspart.shop
-
ctivemail5-kagoya-com.info
-
shacertification9.shop
-
zitcd65k3.buzz
-
llkosoi.info
-
ru8.info
-
rhgtrdjdjykyetrdjftd.buzz
-
yschoollist.kiwi
-
oftfolio.online
-
rograma-de-almacen-2.online
-
oudoarms.top
-
mwquas.xyz
-
orjagaucha.website
-
nlinechat-mh.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Formbook payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\www.exe"C:\Users\Admin\AppData\Local\Temp\www.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3488-1099-0x0000000008880000-0x0000000008979000-memory.dmp
memory/3488-1111-0x0000000008BF0000-0x0000000008D05000-memory.dmp
memory/3488-1108-0x0000000008BF0000-0x0000000008D05000-memory.dmp
memory/3488-1105-0x0000000008880000-0x0000000008979000-memory.dmp
memory/3740-1103-0x0000000000DD0000-0x0000000000DE7000-memory.dmp
memory/3900-1093-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3900-1095-0x0000000001380000-0x00000000016CA000-memory.dmp
memory/3900-1098-0x0000000001330000-0x0000000001345000-memory.dmp
memory/3900-1097-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4228-30-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-21-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-67-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-65-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-63-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-61-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-57-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-55-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-53-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-51-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-49-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-48-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4228-46-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-42-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-40-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-38-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-36-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-34-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-32-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-26-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-28-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-24-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-22-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-59-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-18-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-16-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-14-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-10-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-8-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-6-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-4-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-3-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-12-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-1078-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4228-1080-0x0000000005D20000-0x0000000005D6C000-memory.dmp
memory/4228-1079-0x0000000005210000-0x0000000005288000-memory.dmp
memory/4228-1081-0x0000000005E60000-0x0000000005EF2000-memory.dmp
memory/4228-1082-0x0000000005F00000-0x0000000005F66000-memory.dmp
memory/4228-1086-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4228-1087-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4228-44-0x0000000005580000-0x0000000005678000-memory.dmp
memory/4228-2-0x0000000005580000-0x000000000567E000-memory.dmp
memory/4228-1-0x00000000007D0000-0x00000000008D6000-memory.dmp
memory/4228-0-0x00000000746DE000-0x00000000746DF000-memory.dmp
memory/4228-1088-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4228-1089-0x00000000067D0000-0x0000000006D74000-memory.dmp
memory/4228-1090-0x0000000006220000-0x0000000006274000-memory.dmp
memory/4228-1094-0x00000000746D0000-0x0000000074E80000-memory.dmp