Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 09:18

General

  • Target

    RFQ_BDS636011.exe

  • Size

    694KB

  • MD5

    74f8407f98ac51a0b9feb8782bd8f7c9

  • SHA1

    d49d93ac8941442fe52eda4b1240f3afd620bb08

  • SHA256

    53a703b29d5aebc4a0b5794d0904e49aa90d72525018df4f9121e5da86116534

  • SHA512

    9ee6d913eeabc524e2f271b87e7df993adeb886299ec12ceb81790355d234439fac5ab2c98f6cbcca6742bcb0abe3fd603add6bcdd17ea0bf8ebdda12c6aa790

  • SSDEEP

    12288:xXFAO0Qb6xMem7HGKCdt44epEx3linXjVdiyqkkHnZ4CCVjscJ4nX0q2mY9+QQhX:xXFN0Yem7Q3yOx3gnXRdiZ9HkV+nX0qj

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy29

Decoy

obswell.online

etflix.luxury

ulunguwethu.store

ulbcenter.shop

nswering-service-mi-de-tt.click

upport-marketplace84.click

wepxbd163.lat

mplants-doctors.today

aofexf90yj.top

hermodynamic.space

dfg3n489.cyou

off.gay

alkak.cam

ijanarko.net

7tl.site

yaanincma.store

ires-47022.bond

elek4dalt77.xyz

foxsakepeople.online

ndefeatedqs.shop

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Guloader family
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Formbook payload 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    PID:3416
    • C:\Users\Admin\AppData\Local\Temp\RFQ_BDS636011.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ_BDS636011.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4432
      • C:\Users\Admin\AppData\Local\Temp\RFQ_BDS636011.exe
        "C:\Users\Admin\AppData\Local\Temp\RFQ_BDS636011.exe"
        3⤵
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1400
        • C:\Windows\SysWOW64\raserver.exe
          "C:\Windows\SysWOW64\raserver.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2600
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\RFQ_BDS636011.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3132

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nso832C.tmp\System.dll

    Filesize

    12KB

    MD5

    4add245d4ba34b04f213409bfe504c07

    SHA1

    ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    SHA256

    9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    SHA512

    1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

  • memory/1400-18-0x0000000001660000-0x00000000036BE000-memory.dmp

    Filesize

    32.4MB

  • memory/1400-22-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/1400-21-0x0000000001660000-0x00000000036BE000-memory.dmp

    Filesize

    32.4MB

  • memory/1400-20-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/1400-19-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/1400-16-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/2600-24-0x0000000000740000-0x000000000075F000-memory.dmp

    Filesize

    124KB

  • memory/2600-23-0x0000000000740000-0x000000000075F000-memory.dmp

    Filesize

    124KB

  • memory/2600-25-0x0000000000430000-0x000000000045F000-memory.dmp

    Filesize

    188KB

  • memory/3416-27-0x0000000008040000-0x00000000080FF000-memory.dmp

    Filesize

    764KB

  • memory/4432-17-0x0000000005800000-0x000000000785E000-memory.dmp

    Filesize

    32.4MB

  • memory/4432-15-0x0000000074475000-0x0000000074476000-memory.dmp

    Filesize

    4KB

  • memory/4432-14-0x0000000005800000-0x000000000785E000-memory.dmp

    Filesize

    32.4MB

  • memory/4432-13-0x0000000077D81000-0x0000000077EA1000-memory.dmp

    Filesize

    1.1MB

  • memory/4432-12-0x0000000005800000-0x000000000785E000-memory.dmp

    Filesize

    32.4MB