Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-12-2024 01:21

General

  • Target

    1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe

  • Size

    1.0MB

  • MD5

    58923ab5edc1d65d3f0fb3c71ee2af64

  • SHA1

    5de29822b230043708b6725b3fe0e9f2eb1ad21a

  • SHA256

    1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e

  • SHA512

    d8c28559e79783cccbb9b2fac8c3a2b29471b87035c326be203ab486c62df8a6b7a59c4ecffe87cea6e201fc825274faa6b3befe7a3a735f154d567abbb09b32

  • SSDEEP

    24576:mu6J33O0c+JY5UZ+XC0kGso6FatnXQN8TyT1soHDWY:ou0c++OCvkGs9FatgaTusoiY

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

at22

Decoy

etween-us.online

sphaleia.net

ental-implants-78350.bond

q4a.lat

commerce-97292.bond

linds-curtains-38811.bond

gyptevoyages.net

landofigueroa-abogados.net

cuitis.xyz

hantom.city

yzk.online

afikabmedan.store

ome-remodeling-67289.bond

ebpage-klzdxrhnazi.shop

eject.lol

rismart.xyz

nfluencer-marketing-72407.bond

ksolotl.xyz

ebsbayrntilrmizin93.xyz

pps-75399.bond

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 5 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3572
    • C:\Users\Admin\AppData\Local\Temp\1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe
      "C:\Users\Admin\AppData\Local\Temp\1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\1ddd6b7f64ff57668ca9087e77362e4d11fda7c3c07aebe6c1f48b560aea038e.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2396
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 660
        3⤵
        • Program crash
        PID:2072
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:1700
      • C:\Windows\SysWOW64\autochk.exe
        "C:\Windows\SysWOW64\autochk.exe"
        2⤵
          PID:2372
        • C:\Windows\SysWOW64\autochk.exe
          "C:\Windows\SysWOW64\autochk.exe"
          2⤵
            PID:4068
          • C:\Windows\SysWOW64\autochk.exe
            "C:\Windows\SysWOW64\autochk.exe"
            2⤵
              PID:4844
            • C:\Windows\SysWOW64\autochk.exe
              "C:\Windows\SysWOW64\autochk.exe"
              2⤵
                PID:1280
              • C:\Windows\SysWOW64\msiexec.exe
                "C:\Windows\SysWOW64\msiexec.exe"
                2⤵
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:560
                • C:\Windows\SysWOW64\cmd.exe
                  /c del "C:\Windows\SysWOW64\svchost.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2416
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1288 -ip 1288
              1⤵
                PID:4048

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/560-25-0x00000000004F0000-0x000000000051F000-memory.dmp

                Filesize

                188KB

              • memory/560-23-0x00000000004F0000-0x000000000051F000-memory.dmp

                Filesize

                188KB

              • memory/560-18-0x00000000004D0000-0x00000000004E2000-memory.dmp

                Filesize

                72KB

              • memory/560-22-0x00000000004D0000-0x00000000004E2000-memory.dmp

                Filesize

                72KB

              • memory/560-20-0x00000000004D0000-0x00000000004E2000-memory.dmp

                Filesize

                72KB

              • memory/560-27-0x0000000002210000-0x00000000022A4000-memory.dmp

                Filesize

                592KB

              • memory/560-24-0x00000000023A0000-0x00000000026EA000-memory.dmp

                Filesize

                3.3MB

              • memory/1288-6-0x0000000001250000-0x0000000001650000-memory.dmp

                Filesize

                4.0MB

              • memory/2396-11-0x0000000001F80000-0x0000000001F95000-memory.dmp

                Filesize

                84KB

              • memory/2396-8-0x0000000001B00000-0x0000000001E4A000-memory.dmp

                Filesize

                3.3MB

              • memory/2396-7-0x0000000000400000-0x000000000042F000-memory.dmp

                Filesize

                188KB

              • memory/2396-14-0x0000000000400000-0x000000000042F000-memory.dmp

                Filesize

                188KB

              • memory/2396-15-0x00000000038F0000-0x0000000003905000-memory.dmp

                Filesize

                84KB

              • memory/2396-10-0x0000000000400000-0x000000000042F000-memory.dmp

                Filesize

                188KB

              • memory/3572-17-0x0000000002B00000-0x0000000002C0F000-memory.dmp

                Filesize

                1.1MB

              • memory/3572-12-0x0000000002B00000-0x0000000002C0F000-memory.dmp

                Filesize

                1.1MB

              • memory/3572-16-0x00000000080F0000-0x0000000008243000-memory.dmp

                Filesize

                1.3MB

              • memory/3572-26-0x00000000080F0000-0x0000000008243000-memory.dmp

                Filesize

                1.3MB

              • memory/3572-30-0x0000000008250000-0x00000000082E9000-memory.dmp

                Filesize

                612KB

              • memory/3572-32-0x0000000008250000-0x00000000082E9000-memory.dmp

                Filesize

                612KB

              • memory/3572-33-0x0000000008250000-0x00000000082E9000-memory.dmp

                Filesize

                612KB