Analysis

  • max time kernel
    146s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-09-2024 00:07

General

  • Target

    Bonifico2692024pdf.exe

  • Size

    1.1MB

  • MD5

    ab5a5fadd9a58b412281fa7c040c54ef

  • SHA1

    d67c6a5fb65869cbb381c0a8276dea5e30ecfed1

  • SHA256

    e4d1f88b5db146a70bce062886dd60b15d13bda9b325535ef4d3ffcb484981ec

  • SHA512

    fd4144fccc27cab79fa9001e9847a65cc778f01c1d2311babc8982cd30c6ba4f2e85d8059f68b9111cfe103d29172dd40d4aadc6e29cb3db60a07e2af5d321f9

  • SSDEEP

    24576:PAHnh+eWsN3skA4RV1Hom2KXMmHara7ystgXDMSJA1p5:yh+ZkldoPK8Yara7y4S5Wl

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e23y

Decoy

stiloeconforto.shop

79nn470gl.autos

ffg.autos

elix-saaac.buzz

tlasbet88win.sbs

inoliga.app

777.fun

avada-ga-3.press

avandakitchen.online

61ep864tr.autos

igitalonlineseva.online

ar-deals-15908.bond

sqqpkv.pro

368i8rnoy.xyz

lxspinsenin.lol

9y204r7eo.sbs

toptalkingaboutit.net

eeplab.xyz

filmyhit.vip

athroom-remodeling-59089.bond

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Users\Admin\AppData\Local\Temp\Bonifico2692024pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Bonifico2692024pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\Bonifico2692024pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1468
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 684
        3⤵
        • Program crash
        PID:3180
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3232
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4788
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5004 -ip 5004
    1⤵
      PID:2172

    Network

    • flag-us
      DNS
      241.150.49.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.150.49.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      83.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      83.210.23.2.in-addr.arpa
      IN PTR
      Response
      83.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-83deploystaticakamaitechnologiescom
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      149.220.183.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      149.220.183.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      183.59.114.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      183.59.114.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      www.filmyhit.vip
      Remote address:
      8.8.8.8:53
      Request
      www.filmyhit.vip
      IN A
      Response
      www.filmyhit.vip
      IN A
      46.175.150.247
    • flag-nl
      GET
      http://www.filmyhit.vip/e23y/?Ezrxu=9NElfXPu5ecZBRj7yXKDMGZSSmBmvFVpoUbMoZD6TZgeXSW70/jcbsqC9jyafvs+grBu&1bw=wHIhWlh8IzNXfpzP
      Explorer.EXE
      Remote address:
      46.175.150.247:80
      Request
      GET /e23y/?Ezrxu=9NElfXPu5ecZBRj7yXKDMGZSSmBmvFVpoUbMoZD6TZgeXSW70/jcbsqC9jyafvs+grBu&1bw=wHIhWlh8IzNXfpzP HTTP/1.1
      Host: www.filmyhit.vip
      Connection: close
      Response
      HTTP/1.1 301 Moved Permanently
      Server: nginx
      Date: Fri, 27 Sep 2024 00:08:28 GMT
      Content-Type: text/html
      Content-Length: 162
      Connection: close
      Location: http://filmyhit.vip/e23y/?Ezrxu=9NElfXPu5ecZBRj7yXKDMGZSSmBmvFVpoUbMoZD6TZgeXSW70/jcbsqC9jyafvs+grBu&1bw=wHIhWlh8IzNXfpzP
    • flag-us
      DNS
      247.150.175.46.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      247.150.175.46.in-addr.arpa
      IN PTR
      Response
      247.150.175.46.in-addr.arpa
      IN PTR
      campers6ga
    • flag-us
      DNS
      www.reakinggroundtherapy.pro
      Remote address:
      8.8.8.8:53
      Request
      www.reakinggroundtherapy.pro
      IN A
      Response
    • flag-us
      DNS
      88.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.210.23.2.in-addr.arpa
      IN PTR
      Response
      88.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-88deploystaticakamaitechnologiescom
    • flag-us
      DNS
      www.elationship-coach-72450.bond
      Remote address:
      8.8.8.8:53
      Request
      www.elationship-coach-72450.bond
      IN A
      Response
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      www.8015.xyz
      Remote address:
      8.8.8.8:53
      Request
      www.8015.xyz
      IN A
      Response
    • flag-us
      DNS
      www.777.fun
      Remote address:
      8.8.8.8:53
      Request
      www.777.fun
      IN A
      Response
      www.777.fun
      IN CNAME
      d2atqkubdsk7og.cloudfront.net
    • 46.175.150.247:80
      http://www.filmyhit.vip/e23y/?Ezrxu=9NElfXPu5ecZBRj7yXKDMGZSSmBmvFVpoUbMoZD6TZgeXSW70/jcbsqC9jyafvs+grBu&1bw=wHIhWlh8IzNXfpzP
      http
      Explorer.EXE
      399 B
      658 B
      5
      5

      HTTP Request

      GET http://www.filmyhit.vip/e23y/?Ezrxu=9NElfXPu5ecZBRj7yXKDMGZSSmBmvFVpoUbMoZD6TZgeXSW70/jcbsqC9jyafvs+grBu&1bw=wHIhWlh8IzNXfpzP

      HTTP Response

      301
    • 8.8.8.8:53
      241.150.49.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      241.150.49.20.in-addr.arpa

    • 8.8.8.8:53
      83.210.23.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      83.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      149.220.183.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      149.220.183.52.in-addr.arpa

    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      183.59.114.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      183.59.114.20.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      www.filmyhit.vip
      dns
      62 B
      78 B
      1
      1

      DNS Request

      www.filmyhit.vip

      DNS Response

      46.175.150.247

    • 8.8.8.8:53
      247.150.175.46.in-addr.arpa
      dns
      73 B
      98 B
      1
      1

      DNS Request

      247.150.175.46.in-addr.arpa

    • 8.8.8.8:53
      www.reakinggroundtherapy.pro
      dns
      74 B
      156 B
      1
      1

      DNS Request

      www.reakinggroundtherapy.pro

    • 8.8.8.8:53
      88.210.23.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      88.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      www.elationship-coach-72450.bond
      dns
      78 B
      143 B
      1
      1

      DNS Request

      www.elationship-coach-72450.bond

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      www.8015.xyz
      dns
      58 B
      123 B
      1
      1

      DNS Request

      www.8015.xyz

    • 8.8.8.8:53
      www.777.fun
      dns
      57 B
      167 B
      1
      1

      DNS Request

      www.777.fun

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1468-14-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1468-11-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1468-12-0x0000000001800000-0x0000000001B4A000-memory.dmp

      Filesize

      3.3MB

    • memory/1468-15-0x0000000000F90000-0x0000000000FA4000-memory.dmp

      Filesize

      80KB

    • memory/3232-17-0x0000000000D50000-0x0000000000DA7000-memory.dmp

      Filesize

      348KB

    • memory/3232-18-0x0000000000D50000-0x0000000000DA7000-memory.dmp

      Filesize

      348KB

    • memory/3232-20-0x00000000004F0000-0x000000000051F000-memory.dmp

      Filesize

      188KB

    • memory/3472-16-0x000000000A970000-0x000000000AAC9000-memory.dmp

      Filesize

      1.3MB

    • memory/3472-19-0x000000000A970000-0x000000000AAC9000-memory.dmp

      Filesize

      1.3MB

    • memory/3472-24-0x0000000002DE0000-0x0000000002EBC000-memory.dmp

      Filesize

      880KB

    • memory/3472-25-0x0000000002DE0000-0x0000000002EBC000-memory.dmp

      Filesize

      880KB

    • memory/3472-27-0x0000000002DE0000-0x0000000002EBC000-memory.dmp

      Filesize

      880KB

    • memory/5004-10-0x0000000000CD0000-0x0000000000CD4000-memory.dmp

      Filesize

      16KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.