Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
07-11-2024 09:21
General
-
Target
PO 026235Medline (Shanghai) Industries, Inc..exe
-
Size
739KB
-
MD5
324a001765714ace68f36be3dbba911b
-
SHA1
97d0663bbe94c1b48385cbcb99f5edb13b44191a
-
SHA256
07888aca315d288cf934104bbee91f5a2d6cec258f9e8052adfb496cc7ea1f16
-
SHA512
fb8a462887ef68009a1d2c1128df2122d2dbfb8c2e95dd197922a46e615ef7951be98b85522d9507078e83d46f4b16bec1fc331cede369df79845c2e6d2fce62
-
SSDEEP
12288:WgWVfEys3/9TwDdteNle31LI18mTeHluHDv2Cel/iWGEvkiDEmbGq:HWVfEn1To4C1s5eHlovBo/iWGEcnmN
Malware Config
Extracted
formbook
4.1
md49
enithpro.shop
utozeed.agency
ornpicsbd.xyz
82yjj301.top
kphone.online
3ccha73hdl5.shop
seinow.online
usurrofest.info
2ads2s2.top
oritskul.net
etlivecasino.bet
erts.navy
anieubezpieczenia.online
dyhph1020pm.top
paceglide.space
ibmedia.net
arwyking.icu
soriaticarthritis101.today
earopia.shop
gctg2qt4h.top
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Formbook payload 4 IoCs
-
Deletes itself 1 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\PO 026235Medline (Shanghai) Industries, Inc..exe"C:\Users\Admin\AppData\Local\Temp\PO 026235Medline (Shanghai) Industries, Inc..exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 026235Medline (Shanghai) Industries, Inc..exe"C:\Users\Admin\AppData\Local\Temp\PO 026235Medline (Shanghai) Industries, Inc..exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO 026235Medline (Shanghai) Industries, Inc..exe"5⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
4.0MB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
1.6MB
-
Filesize
1024KB
-
Filesize
3.0MB
-
Filesize
84KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
188KB
-
Filesize
84KB
-
Filesize
188KB
-
Filesize
6.9MB
-
Filesize
112KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
472KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
768KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
188KB