Analysis

  • max time kernel
    146s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2024 11:32

General

  • Target

    file.exe

  • Size

    245KB

  • MD5

    b3dde83063baaefdf29069d8ae56586c

  • SHA1

    a46e93859fc21ed36bc527441ea3abe5e72511f2

  • SHA256

    881801925309c53cb0b35b81e01deb696f687753c68832d3b852c3825e9192e2

  • SHA512

    89a6be5ac8c7e3291c3008c755a8babd827b0d8aa689625811977a660a93693ef6f782565be588866efc16bf8bffbf595987c4391d4ce33a0a9c93a5a83656bd

  • SSDEEP

    6144:MTqjFaFHPGJiJhGXpHHiI5vLsow/4gbQOECWImPF:MfFHPG0GXpiIdLK/4AQOELhPF

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bk2s

Decoy

smartchoice.education

sofiaalva.com

angiepologie.com

ohiocommunitynewsnetwork.com

bloodsweatnskills.com

creaturescreate.com

futureadb.com

aimuseums.com

freetimecleaningservices.com

melissadishes.com

xn--tr-trkiye-t9a.com

uxlunexpectedlawyer.com

vinh-heritage.net

cyberzenith.com

zhaigoo.com

flirt-girls.icu

bestivfcenterpune.com

oxbstwnm.icu

chocolatejerky.com

onshore-energy.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Users\Admin\AppData\Local\Temp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\file.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2504
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\SysWOW64\mstsc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\file.exe"
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2144

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsdC3DD.tmp\System.dll

    Filesize

    10KB

    MD5

    56a321bd011112ec5d8a32b2f6fd3231

    SHA1

    df20e3a35a1636de64df5290ae5e4e7572447f78

    SHA256

    bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

    SHA512

    5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

  • memory/1256-15-0x00000000063A0000-0x00000000064B9000-memory.dmp

    Filesize

    1.1MB

  • memory/1256-20-0x00000000063A0000-0x00000000064B9000-memory.dmp

    Filesize

    1.1MB

  • memory/2504-12-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2504-14-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3000-17-0x0000000000960000-0x0000000000A64000-memory.dmp

    Filesize

    1.0MB

  • memory/3000-19-0x0000000000960000-0x0000000000A64000-memory.dmp

    Filesize

    1.0MB