Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2024, 02:28

General

  • Target

    53ef40005eacaaf2c37175d6f38dfa8d9efe91d4513dc545cd7176924d9e64ef.exe

  • Size

    681KB

  • MD5

    580d52f93549b085b8061f3e699eef17

  • SHA1

    9e9acbdb7fd7b1ded9d18a8aeee40355a2ec7790

  • SHA256

    53ef40005eacaaf2c37175d6f38dfa8d9efe91d4513dc545cd7176924d9e64ef

  • SHA512

    fe08643b09d4ddd0f6125a7e89a8204a94618238444a4a7339b26a82041af06a170bc1c47e685ec71307891118bf15bc9d43a9b7b12a878de2f72c263cc3f382

  • SSDEEP

    12288:8+YLrsVU2hHe8rolfBemE4uNfwY5a+uT5naPRTiLD:JD+8EAmX0Va+A5a5TiL

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cd36

Decoy

hongrobert.top

msurmis.online

tormdamageroof.net

riglashenie-svadby.store

otorcycle-loans-84331.bond

ouriptv.info

eportingcfo.top

2019.vip

ysphoto.online

hrivegorevx.info

350yhc.top

mwakop.xyz

antan4d-amp.xyz

pc-marketing-95267.bond

cuway.tours

inshiaward.top

akuzainu.fun

scenario.live

arrowlaboratorio.shop

nline-gaming-13926.bond

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\53ef40005eacaaf2c37175d6f38dfa8d9efe91d4513dc545cd7176924d9e64ef.exe
    "C:\Users\Admin\AppData\Local\Temp\53ef40005eacaaf2c37175d6f38dfa8d9efe91d4513dc545cd7176924d9e64ef.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\53ef40005eacaaf2c37175d6f38dfa8d9efe91d4513dc545cd7176924d9e64ef.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2800
    • C:\Users\Admin\AppData\Local\Temp\53ef40005eacaaf2c37175d6f38dfa8d9efe91d4513dc545cd7176924d9e64ef.exe
      "C:\Users\Admin\AppData\Local\Temp\53ef40005eacaaf2c37175d6f38dfa8d9efe91d4513dc545cd7176924d9e64ef.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2768

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1712-0-0x0000000074E2E000-0x0000000074E2F000-memory.dmp

          Filesize

          4KB

        • memory/1712-1-0x0000000000DF0000-0x0000000000EA0000-memory.dmp

          Filesize

          704KB

        • memory/1712-2-0x0000000074E20000-0x000000007550E000-memory.dmp

          Filesize

          6.9MB

        • memory/1712-3-0x0000000000480000-0x000000000049E000-memory.dmp

          Filesize

          120KB

        • memory/1712-4-0x0000000074E2E000-0x0000000074E2F000-memory.dmp

          Filesize

          4KB

        • memory/1712-5-0x0000000074E20000-0x000000007550E000-memory.dmp

          Filesize

          6.9MB

        • memory/1712-6-0x00000000005A0000-0x0000000000616000-memory.dmp

          Filesize

          472KB

        • memory/1712-14-0x0000000074E20000-0x000000007550E000-memory.dmp

          Filesize

          6.9MB

        • memory/2768-13-0x0000000000770000-0x0000000000A73000-memory.dmp

          Filesize

          3.0MB

        • memory/2768-12-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2768-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2768-8-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2768-7-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB