Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2024 11:50

General

  • Target

    Order Nr U764D.exe

  • Size

    255KB

  • MD5

    04a169e7e5c9ea7a92a2ab3debf63f41

  • SHA1

    c1b35c61e8ee1382f7f83c182ccadf4bac6be2e8

  • SHA256

    afc6417a1f71fe5406d149c95b046b997a99421f92f4fb8398908b73675c2012

  • SHA512

    c5c932f02ae2f6ad6a67418a3302356fde44fa194eb9f6d02e6c150865fd9b87892187bf3e6aa379e9caea90892a8238b9ac3925e4e77444a2cfaa81dcf517fb

  • SSDEEP

    6144:mbE/HUbWRhd2L+uUgXCafRcIVqvP5xGKO1B3kqg4:mb/EhS33cIVqZAKUXp

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mr06

Decoy

dreamrose.shop

bamdadlive.com

avastfr.com

aishabolduc.design

nobulldownhill.com

navis.store

paintingsantaclarita.com

wdidfhqo9751ds.link

epilateurlaser.info

expertdoctor.xyz

jtfaqyxo.work

zrexvita.live

coloradomarketingfirm.com

prestigehospitality.solutions

bmayple.com

sea-food.online

mejor-proteccion-es.click

tophatlimitless.buzz

inailshickorycreek.com

tintash-sg.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Users\Admin\AppData\Local\Temp\Order Nr U764D.exe
      "C:\Users\Admin\AppData\Local\Temp\Order Nr U764D.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Users\Admin\AppData\Local\Temp\nnmdtjq.exe
        "C:\Users\Admin\AppData\Local\Temp\nnmdtjq.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Users\Admin\AppData\Local\Temp\nnmdtjq.exe
          "C:\Users\Admin\AppData\Local\Temp\nnmdtjq.exe"
          4⤵
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2948
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:2944
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:3012
        • C:\Windows\SysWOW64\autoconv.exe
          "C:\Windows\SysWOW64\autoconv.exe"
          2⤵
            PID:2908
          • C:\Windows\SysWOW64\autoconv.exe
            "C:\Windows\SysWOW64\autoconv.exe"
            2⤵
              PID:1476
            • C:\Windows\SysWOW64\autoconv.exe
              "C:\Windows\SysWOW64\autoconv.exe"
              2⤵
                PID:2372
              • C:\Windows\SysWOW64\autoconv.exe
                "C:\Windows\SysWOW64\autoconv.exe"
                2⤵
                  PID:2920
                • C:\Windows\SysWOW64\autoconv.exe
                  "C:\Windows\SysWOW64\autoconv.exe"
                  2⤵
                    PID:2924
                  • C:\Windows\SysWOW64\autoconv.exe
                    "C:\Windows\SysWOW64\autoconv.exe"
                    2⤵
                      PID:2168
                    • C:\Windows\SysWOW64\autoconv.exe
                      "C:\Windows\SysWOW64\autoconv.exe"
                      2⤵
                        PID:2176
                      • C:\Windows\SysWOW64\cmstp.exe
                        "C:\Windows\SysWOW64\cmstp.exe"
                        2⤵
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2772
                        • C:\Windows\SysWOW64\cmd.exe
                          /c del "C:\Users\Admin\AppData\Local\Temp\nnmdtjq.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2588

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\copmmpzmfyt.ogp

                      Filesize

                      4KB

                      MD5

                      b472438e8c315aa6af34d23e91d6b0a7

                      SHA1

                      5f3c21d6e3da172c95039f8d78ef3d9887ba287d

                      SHA256

                      fd25e44e4e65785d90081fafe4a1ef3629b41a9d37acb833460e789f9e9a921e

                      SHA512

                      76e6b57bb44bf7cbdca74f6fead456c3b50680fb77c1573d2967513002d05bae2509166de8c7946375ce3da139e2ee04cd0c78f9e3d46801e5f170c73f0c06fd

                    • C:\Users\Admin\AppData\Local\Temp\nnmdtjq.exe

                      Filesize

                      59KB

                      MD5

                      8b5d0587ce1121389864bdcf9559d294

                      SHA1

                      2b903d531834992e37fab920d7b000187a9833bc

                      SHA256

                      f57122b7b5a7eff1b245080a876201adfe42eefa299d30dfc140f0427e139285

                      SHA512

                      79e92611bab464b6c56f6fb7da20d688a6d0852f9515eb68065ddfca71a6d507f591fd8e6c7a7696b025f8d1341953b920c4abd6b170f34cc6c173fc50d72f6a

                    • C:\Users\Admin\AppData\Local\Temp\qgztobna.uag

                      Filesize

                      185KB

                      MD5

                      82c6372659af5de6f973de4939e76030

                      SHA1

                      7e88829c2585ffac7531d6e33a0778cef45d75c8

                      SHA256

                      766b75812ff45f89b27284d5371aa5afc14dd84326a362de173e40f8c919a822

                      SHA512

                      ab5fd72c8a41183206d365b409ccf79fe6752319e0b55e440b34f84a258eb91983dd5bcaf3cfe36e9a695bf5e5679a9cea57f998b951b782458c67b4afcddc77

                    • memory/1412-18-0x0000000006BA0000-0x0000000006D22000-memory.dmp

                      Filesize

                      1.5MB

                    • memory/1412-29-0x0000000004150000-0x00000000041F0000-memory.dmp

                      Filesize

                      640KB

                    • memory/1412-24-0x0000000006BA0000-0x0000000006D22000-memory.dmp

                      Filesize

                      1.5MB

                    • memory/1412-17-0x0000000000010000-0x0000000000020000-memory.dmp

                      Filesize

                      64KB

                    • memory/2584-9-0x0000000000090000-0x0000000000092000-memory.dmp

                      Filesize

                      8KB

                    • memory/2772-20-0x0000000000E00000-0x0000000000E18000-memory.dmp

                      Filesize

                      96KB

                    • memory/2772-22-0x0000000000E00000-0x0000000000E18000-memory.dmp

                      Filesize

                      96KB

                    • memory/2772-23-0x0000000000090000-0x00000000000BF000-memory.dmp

                      Filesize

                      188KB

                    • memory/2948-15-0x000000000041F000-0x0000000000420000-memory.dmp

                      Filesize

                      4KB

                    • memory/2948-16-0x0000000000400000-0x000000000042F000-memory.dmp

                      Filesize

                      188KB

                    • memory/2948-14-0x0000000000770000-0x0000000000A73000-memory.dmp

                      Filesize

                      3.0MB