Analysis

  • max time kernel
    146s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 20:05

General

  • Target

    Factura_855.pdf.exe

  • Size

    214KB

  • MD5

    fbcc50e49a03f6b2469352851fcc0800

  • SHA1

    63f99919354e58010819251556f5ace361b7c390

  • SHA256

    498cbaa02846904c60c9a349f49bc72a046d1cd686d858286f33cfcf39716215

  • SHA512

    d7080f1d75a1f88d56d24da1f8d132625236a6057f5d0571bcac387afa27c2a294983d3df952bea8592812415d4210f4136f5a367b4cf81883e3d487c580b7f7

  • SSDEEP

    6144:HNeZmOQDVfP9e6oAzSI/2Cou2L2YlOPrYbihN:HNlOQZP9e6RzS5c2LZcUU

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m0r9

Decoy

neekoluldao.com

pandolam.com

homestore.website

inthemoart.com

plubmingcny.com

tsandjsdjproductions.com

bangkok-bars.com

theroganexperience.com

cisneros.media

cxaerfa.xyz

dalafea.online

eppsallen.com

kksm1.com

navega.site

coloradonews.info

rnhues3j.xyz

languageslibrary.com

metapharmacyphuket.net

invisiblelady.com

suculentaycactaceo3d.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Users\Admin\AppData\Local\Temp\Factura_855.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Factura_855.pdf.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Users\Admin\AppData\Local\Temp\qfmjhb.exe
        C:\Users\Admin\AppData\Local\Temp\qfmjhb.exe C:\Users\Admin\AppData\Local\Temp\yqmxitinks
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:772
        • C:\Users\Admin\AppData\Local\Temp\qfmjhb.exe
          C:\Users\Admin\AppData\Local\Temp\qfmjhb.exe C:\Users\Admin\AppData\Local\Temp\yqmxitinks
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2544
    • C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\SysWOW64\chkdsk.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2264
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\qfmjhb.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ncbe92xxyz7k26e4s88j

    Filesize

    184KB

    MD5

    d55278f3c9ddd6df247d043d0f4d334e

    SHA1

    2aa2b417aa8897935f5cc77ab8a7617ef8d75861

    SHA256

    d9f4d5de73452115d9acdccda02398bc5c5a2b4b99d6dc5d8feea4584856cf53

    SHA512

    1bf4175795d93a4d0c6dc7a7acefb15204558087d9f918ddb3de2caaf2d67fd63785bee2f7a6f3aafa025f7ccafeb4043403dc18728633fd1abab27b6820e732

  • C:\Users\Admin\AppData\Local\Temp\yqmxitinks

    Filesize

    5KB

    MD5

    7c7487f9e5f0a2b42c974896825d06e5

    SHA1

    d29382ebaae67bf9de891ad00adb795963ef8967

    SHA256

    dd31e7b319d3acfe238866035e0dfe514fc55efe7343e1e13421dd32d20b8f80

    SHA512

    913039ce08f36b0664657bcf70b77238656810e96154f890f42daeff7b60cc304751a457b98cf2adacbe701eee27e358487a7be6c4d723c7e39d51bc43fdae9f

  • \Users\Admin\AppData\Local\Temp\qfmjhb.exe

    Filesize

    5KB

    MD5

    d93c0902c13f3f17012c2778fd24b009

    SHA1

    7ad3d53210ce587d2195545115c9086457a14623

    SHA256

    0487ed5d2a046ee552e410b5c9b3cf27eb0c3b369fecff3132c58e57eb1c0ad8

    SHA512

    4cb2d5beb7ed5532819bd96c92000c9e12f145d37cdd2ad4dec3f67ce74107c4a00fb850700015168ef6c2620277c237de3a2c279a99150ed46a3d0b5905fc3a

  • memory/772-12-0x00000000002E0000-0x00000000002E2000-memory.dmp

    Filesize

    8KB

  • memory/1200-19-0x0000000005050000-0x0000000005114000-memory.dmp

    Filesize

    784KB

  • memory/1200-25-0x0000000005050000-0x0000000005114000-memory.dmp

    Filesize

    784KB

  • memory/1200-30-0x0000000006890000-0x00000000069FF000-memory.dmp

    Filesize

    1.4MB

  • memory/1200-31-0x0000000006890000-0x00000000069FF000-memory.dmp

    Filesize

    1.4MB

  • memory/1200-33-0x0000000006890000-0x00000000069FF000-memory.dmp

    Filesize

    1.4MB

  • memory/2264-22-0x0000000000280000-0x0000000000287000-memory.dmp

    Filesize

    28KB

  • memory/2264-23-0x0000000000280000-0x0000000000287000-memory.dmp

    Filesize

    28KB

  • memory/2264-24-0x0000000000110000-0x000000000013F000-memory.dmp

    Filesize

    188KB

  • memory/2544-18-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2544-15-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB