Analysis

  • max time kernel
    80s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 16:27

General

  • Target

    a666dc5c6765f6912878fc840aceaf82.exe

  • Size

    600KB

  • MD5

    a666dc5c6765f6912878fc840aceaf82

  • SHA1

    9f804c5d474f723f6c08cac07569c237c25286a7

  • SHA256

    a3a0f6ef77d8d2270b5baac5ac9185bdf9e30351e61cb6f7a90c76601e004b15

  • SHA512

    4835ff70937f9b5f0da3e2ff61126255b1da74e7c0be00654e062b9b5463ad10380b1e2952c7ccaf05d9090a03c8a020ec6baf6cd7b3259ab54e3de57582553b

  • SSDEEP

    12288:hhr8bQb07Lo2kJc9SkHKksvXYXaGtfTiGEXV9JT6newNcGn:gIEcWSkMvoKGtfTiGAWqW

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bopi

Decoy

zq4.top

relationship-coach-88497.bond

destekbirimi.xyz

tgh-reg.xyz

pepcapital.net

edunote.media

loans-credits-63765.bond

zhxgtlw.top

rajalele.xyz

ug-tower.asia

agrajter.com

investment-services-44387.bond

yaoxiaocang.fun

23win6.top

used-cars-84168.bond

primesourceglobal.net

indiapostsk.vip

qe2i7cghzpebk.buzz

furniture-27975.bond

fy489tysiot4twoinsr3295y78h.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a666dc5c6765f6912878fc840aceaf82.exe
    "C:\Users\Admin\AppData\Local\Temp\a666dc5c6765f6912878fc840aceaf82.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a666dc5c6765f6912878fc840aceaf82.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2944
    • C:\Users\Admin\AppData\Local\Temp\a666dc5c6765f6912878fc840aceaf82.exe
      "C:\Users\Admin\AppData\Local\Temp\a666dc5c6765f6912878fc840aceaf82.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2216-6-0x0000000004D60000-0x0000000004DD6000-memory.dmp

    Filesize

    472KB

  • memory/2216-1-0x00000000012D0000-0x000000000136C000-memory.dmp

    Filesize

    624KB

  • memory/2216-2-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/2216-3-0x00000000004B0000-0x00000000004C2000-memory.dmp

    Filesize

    72KB

  • memory/2216-4-0x000000007415E000-0x000000007415F000-memory.dmp

    Filesize

    4KB

  • memory/2216-5-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/2216-0-0x000000007415E000-0x000000007415F000-memory.dmp

    Filesize

    4KB

  • memory/2216-12-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/2792-7-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2792-11-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2792-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2792-8-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2792-15-0x0000000000A00000-0x0000000000D03000-memory.dmp

    Filesize

    3.0MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.