Overview

overview

10

Static

static

5

list nr 00...cx.exe

windows7-x64

10

list nr 00...cx.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 03:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    list nr 001220_51_2024-11-19_134943.docx.exe

  • Size

    1.1MB

  • MD5

    93bfc296f24d789a7201194a62a84b00

  • SHA1

    23871f9da18f3a7cbe4491fb0152f38b2c6cf959

  • SHA256

    dcb0dbfb5714fc8d31fb3ac35f060092959f1450655eac659d6f4ff36c3c790d

  • SHA512

    edb3cdf1e897ed07883548df5009d2a7dc5037871484f20e790701c29b0732016b1bf6834f712dc21b62d9b26834aafb6735bea54c4ed573c5be7151d68937df

  • SSDEEP

    24576:htb20pkaCqT5TBWgNQ7aWcgLfFAJwGYBU6A:yVg5tQ7aWc6AJwvO5

Score
10/10
formbookud04discoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ud04

Decoy

oum7.pro

ovonordisk.online

akrzus.pro

tendmtedcpsa.site

mm.foo

animevyhgsft29817.click

digdxxb.info

1130.vip

uy-now-pay-later-74776.bond

ybzert.online

edcn.link

rime-flow-bay.xyz

nd777id.beauty

otoyama.shop

lranchomx.xyz

unluoren.top

uglesang-troms.net

udulbet88.net

raquewear.shop

ijanarko.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook family
    formbook
  • Formbook payload 3 IoCs
    rat
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3548
    • C:\Users\Admin\AppData\Local\Temp\list nr 001220_51_2024-11-19_134943.docx.exe
      "C:\Users\Admin\AppData\Local\Temp\list nr 001220_51_2024-11-19_134943.docx.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\list nr 001220_51_2024-11-19_134943.docx.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4112
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:2456
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:4796
        • C:\Windows\SysWOW64\autoconv.exe
          "C:\Windows\SysWOW64\autoconv.exe"
          2⤵
            PID:1088
          • C:\Windows\SysWOW64\autoconv.exe
            "C:\Windows\SysWOW64\autoconv.exe"
            2⤵
              PID:1868
            • C:\Windows\SysWOW64\ipconfig.exe
              "C:\Windows\SysWOW64\ipconfig.exe"
              2⤵
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Gathers network information
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2104
              • C:\Windows\SysWOW64\cmd.exe
                /c del "C:\Windows\SysWOW64\svchost.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2528

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1256-6-0x0000000000DC0000-0x00000000011C0000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/2104-13-0x0000000000790000-0x000000000079B000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2104-15-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

            Download

          • memory/2104-14-0x0000000000790000-0x000000000079B000-memory.dmp

            Filesize

            44KB

            Download

          • memory/3548-12-0x00000000026A0000-0x0000000002771000-memory.dmp

            Filesize

            836KB

            Download

          • memory/3548-16-0x00000000026A0000-0x0000000002771000-memory.dmp

            Filesize

            836KB

            Download

          • memory/3548-20-0x0000000008520000-0x000000000862A000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/3548-21-0x0000000008520000-0x000000000862A000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/3548-23-0x0000000008520000-0x000000000862A000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/4112-10-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

            Download

          • memory/4112-11-0x0000000001A70000-0x0000000001A84000-memory.dmp

            Filesize

            80KB

            Download

          • memory/4112-8-0x0000000001B00000-0x0000000001E4A000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/4112-7-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

            Download