Analysis

  • max time kernel
    146s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    12-12-2024 20:32

General

  • Target

    ORDREDEVIREMENT.exe

  • Size

    712KB

  • MD5

    6cfdfa1de0f031646ee75bde799cb877

  • SHA1

    6da4c76342858daf1c4e55d537ebfe8b846b87b1

  • SHA256

    64a8f5c2209bf86e1aa4489fffa5cf93aee6955b0106909345a313de38ad7885

  • SHA512

    77acb0a4e390c687d5e4c70c9c4b2f4c6b3e01cd53faf61e3d3e760f126c843ec3a51321d5110796891d0409c3eddbae6cf8653e31c19a77d3f411914ccce72d

  • SSDEEP

    12288:nX5Xt1wWT9YeNqKXO0WTmPUIBdL23sUk/d6nifUmyyDdU/wxSc1GFVeDB:hT9YKXO0fbf16nicsWoxS

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bc01

Decoy

epatitis-treatment-26155.bond

52cy67sk.bond

nline-degree-6987776.world

ingxingdiandeng-2033.top

mberbreeze.cyou

48xc300mw.autos

obs-for-seniors-39582.bond

tpetersburg-3-tonn.online

egafon-parser.online

172jh.shop

ltraman.pro

bqfhnys.shop

ntercash24-cad.homes

uhtwister.cloud

alk-in-tubs-27353.bond

ucas-saaad.buzz

oko.events

8080713.xyz

refabricated-homes-74404.bond

inaa.boo

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\ORDREDEVIREMENT.exe
      "C:\Users\Admin\AppData\Local\Temp\ORDREDEVIREMENT.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2312
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ORDREDEVIREMENT.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2912
      • C:\Users\Admin\AppData\Local\Temp\ORDREDEVIREMENT.exe
        "C:\Users\Admin\AppData\Local\Temp\ORDREDEVIREMENT.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2212
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3020
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\ORDREDEVIREMENT.exe"
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1204-20-0x0000000006B80000-0x0000000006D19000-memory.dmp

    Filesize

    1.6MB

  • memory/1204-26-0x00000000003E0000-0x00000000004E0000-memory.dmp

    Filesize

    1024KB

  • memory/1204-25-0x0000000006B80000-0x0000000006D19000-memory.dmp

    Filesize

    1.6MB

  • memory/1204-17-0x0000000004050000-0x0000000004150000-memory.dmp

    Filesize

    1024KB

  • memory/2212-18-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2212-19-0x0000000000180000-0x0000000000194000-memory.dmp

    Filesize

    80KB

  • memory/2212-7-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2212-15-0x0000000000A20000-0x0000000000D23000-memory.dmp

    Filesize

    3.0MB

  • memory/2212-9-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2212-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2212-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2312-14-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2312-6-0x0000000007430000-0x00000000074AA000-memory.dmp

    Filesize

    488KB

  • memory/2312-5-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2312-4-0x00000000747FE000-0x00000000747FF000-memory.dmp

    Filesize

    4KB

  • memory/2312-0-0x00000000747FE000-0x00000000747FF000-memory.dmp

    Filesize

    4KB

  • memory/2312-3-0x0000000000550000-0x0000000000568000-memory.dmp

    Filesize

    96KB

  • memory/2312-2-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2312-1-0x0000000001070000-0x0000000001128000-memory.dmp

    Filesize

    736KB

  • memory/3020-23-0x0000000000930000-0x000000000094C000-memory.dmp

    Filesize

    112KB

  • memory/3020-24-0x0000000000080000-0x00000000000AF000-memory.dmp

    Filesize

    188KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.