Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2024 19:35

General

  • Target

    851eca040f78d215df7b272da1af4a5438c94fc5e9c7685db00ef25f2954bb99.exe

  • Size

    569KB

  • MD5

    d564817bb785c9b4679b720f44372b78

  • SHA1

    a5ad3a1a6213ec64d6047d2d28b569d6a3c8b2b3

  • SHA256

    851eca040f78d215df7b272da1af4a5438c94fc5e9c7685db00ef25f2954bb99

  • SHA512

    4d47376a1aecbd20a5bb97a04e9486f61e4cbcf627e882dbd26890ebc92b2d042e31f3fcc70d294cadf05a0388538dc9a84d6edf243a53625241891e1b1e1bd3

  • SSDEEP

    12288:46J/ZsDPDXWsjZ4s2JQUCM2SuGNmYSTeqf:46pZs7DmsispUCM9V9CeW

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d7ln

Decoy

bulut-imza.com

gotastebuds.com

shutupmags.com

clocksport.com

toweryachtcounsel.com

kingcopier.com

pluspersona.com

inchallahe.com

unclonedconsulting.com

ccdt168.com

tonyzheng.xyz

voiceoftheepeople.com

cicapital.xyz

offxpro.com

loyatiproductions.com

makemebuystuff.com

incuba8labs.com

remparka.com

newstft.com

bgame.pro

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\851eca040f78d215df7b272da1af4a5438c94fc5e9c7685db00ef25f2954bb99.exe
    "C:\Users\Admin\AppData\Local\Temp\851eca040f78d215df7b272da1af4a5438c94fc5e9c7685db00ef25f2954bb99.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Users\Admin\AppData\Local\Temp\851eca040f78d215df7b272da1af4a5438c94fc5e9c7685db00ef25f2954bb99.exe
      "C:\Users\Admin\AppData\Local\Temp\851eca040f78d215df7b272da1af4a5438c94fc5e9c7685db00ef25f2954bb99.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1800-0-0x000000007406E000-0x000000007406F000-memory.dmp

    Filesize

    4KB

  • memory/1800-1-0x00000000000D0000-0x0000000000164000-memory.dmp

    Filesize

    592KB

  • memory/1800-2-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB

  • memory/1800-3-0x0000000001E70000-0x0000000001E7E000-memory.dmp

    Filesize

    56KB

  • memory/1800-4-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB

  • memory/1800-5-0x0000000005C40000-0x0000000005C98000-memory.dmp

    Filesize

    352KB

  • memory/1800-12-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB

  • memory/2880-6-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2880-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2880-11-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2880-7-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2880-13-0x0000000000940000-0x0000000000C43000-memory.dmp

    Filesize

    3.0MB