Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2024 02:02

General

  • Target

    03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe

  • Size

    658KB

  • MD5

    c969389f57b8748516c408694e11189e

  • SHA1

    7ec5fbfe88a6a8d54c647bcc73ac315b513fca92

  • SHA256

    03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6

  • SHA512

    7826cf7c6dc9f556b885fcee682c70cfca2da36f4596838bee85427447d6b129e84d9d43e3a31935525bd21a3b1a5b16c17da0155b96ef7e4774099bfbef06db

  • SSDEEP

    12288:Ucir1S2IoOAc6/5rZGmy4unKZno/iDDjPPqmgucrl4M5iYXybz8xaMhLdrn8qdMW:1nK9o67ZguinMbIxaMhJD8yMEE0

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fh84

Decoy

mtzyn.top

zfn-no-hsts.win

j10g.xyz

arehouse-inventory-60572.bond

nlineprodutooffer.shop

ar-deals-77764.bond

e3m2.xyz

cquisitive.group

unkusol.xyz

01307.xyz

uratedcelebrations.net

nfiniworkshop-thai.online

s-cmc.net

idney360.info

ipolar-treatment-us-311-ze.zone

entenstituleridernegi.biz

olombiaoutlet.shop

uradab.rest

qega.shop

73519.vip

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe
    "C:\Users\Admin\AppData\Local\Temp\03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Users\Admin\AppData\Local\Temp\03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe
      "C:\Users\Admin\AppData\Local\Temp\03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2716-8-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2716-16-0x0000000000830000-0x0000000000B33000-memory.dmp

    Filesize

    3.0MB

  • memory/2716-15-0x0000000000830000-0x0000000000B33000-memory.dmp

    Filesize

    3.0MB

  • memory/2716-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2716-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2716-9-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2932-3-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

    Filesize

    4KB

  • memory/2932-6-0x0000000000C50000-0x0000000000CC6000-memory.dmp

    Filesize

    472KB

  • memory/2932-5-0x00000000003A0000-0x00000000003B2000-memory.dmp

    Filesize

    72KB

  • memory/2932-4-0x0000000074D90000-0x000000007547E000-memory.dmp

    Filesize

    6.9MB

  • memory/2932-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

    Filesize

    4KB

  • memory/2932-14-0x0000000074D90000-0x000000007547E000-memory.dmp

    Filesize

    6.9MB

  • memory/2932-2-0x0000000074D90000-0x000000007547E000-memory.dmp

    Filesize

    6.9MB

  • memory/2932-1-0x0000000000CC0000-0x0000000000D6A000-memory.dmp

    Filesize

    680KB