Analysis
-
max time kernel
146s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 11:32
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
file.exe
-
Size
245KB
-
MD5
b3dde83063baaefdf29069d8ae56586c
-
SHA1
a46e93859fc21ed36bc527441ea3abe5e72511f2
-
SHA256
881801925309c53cb0b35b81e01deb696f687753c68832d3b852c3825e9192e2
-
SHA512
89a6be5ac8c7e3291c3008c755a8babd827b0d8aa689625811977a660a93693ef6f782565be588866efc16bf8bffbf595987c4391d4ce33a0a9c93a5a83656bd
-
SSDEEP
6144:MTqjFaFHPGJiJhGXpHHiI5vLsow/4gbQOECWImPF:MfFHPG0GXpiIdLK/4AQOELhPF
Malware Config
Extracted
formbook
4.1
bk2s
smartchoice.education
sofiaalva.com
angiepologie.com
ohiocommunitynewsnetwork.com
bloodsweatnskills.com
creaturescreate.com
futureadb.com
aimuseums.com
freetimecleaningservices.com
melissadishes.com
xn--tr-trkiye-t9a.com
uxlunexpectedlawyer.com
vinh-heritage.net
cyberzenith.com
zhaigoo.com
flirt-girls.icu
bestivfcenterpune.com
oxbstwnm.icu
chocolatejerky.com
onshore-energy.com
stainedglasshockessinde.com
knektr.online
melaninswagger.com
andreatessler.com
employeerelationships.com
edem-agency.com
dwlrr.com
smacey.com
efrainspura.xyz
a2calf.com
mafalda.cloud
bsankavl.com
izakayajun.com
classifoods.com
wefanthedead.com
extaseestreaming.com
thankyouforthemoments.com
pemeroth.com
lopsenetwork.com
kuromugi-blog.com
ulinzigear.com
shuji-ogawa.com
platinumortho.net
gadgetwoods.com
pyantx.us
dynamicfitnesslife.store
emotionsmanifest.com
ycxlst.com
southerncloseouts.com
lodgespringseniorliving.com
festeringuncle.com
thefuntheboringtheinbetween.com
pennygailpottery.com
mkc.xyz
lilaccityacupuncture.com
resumes2impress.com
icankid.net
oohdough.com
rulrr.info
innerpeaceactivist.com
tusinschoology.com
womanwithacode.com
quyetstar.site
theindependentwings.com
currogpheasantshoot.com
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
resource yara_rule behavioral1/memory/2504-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/2504-14-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2144 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 2364 file.exe 2364 file.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2364 set thread context of 2504 2364 file.exe 30 PID 2504 set thread context of 1256 2504 file.exe 21 PID 3000 set thread context of 1256 3000 mstsc.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2504 file.exe 2504 file.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe 3000 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2364 file.exe 2504 file.exe 2504 file.exe 2504 file.exe 3000 mstsc.exe 3000 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2504 file.exe Token: SeDebugPrivilege 3000 mstsc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2504 2364 file.exe 30 PID 2364 wrote to memory of 2504 2364 file.exe 30 PID 2364 wrote to memory of 2504 2364 file.exe 30 PID 2364 wrote to memory of 2504 2364 file.exe 30 PID 2364 wrote to memory of 2504 2364 file.exe 30 PID 1256 wrote to memory of 3000 1256 Explorer.EXE 31 PID 1256 wrote to memory of 3000 1256 Explorer.EXE 31 PID 1256 wrote to memory of 3000 1256 Explorer.EXE 31 PID 1256 wrote to memory of 3000 1256 Explorer.EXE 31 PID 3000 wrote to memory of 2144 3000 mstsc.exe 33 PID 3000 wrote to memory of 2144 3000 mstsc.exe 33 PID 3000 wrote to memory of 2144 3000 mstsc.exe 33 PID 3000 wrote to memory of 2144 3000 mstsc.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\file.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2144
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD556a321bd011112ec5d8a32b2f6fd3231
SHA1df20e3a35a1636de64df5290ae5e4e7572447f78
SHA256bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
SHA5125354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3