Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2024, 13:40

General

  • Target

    5b65b6044cab0bcb44717f5e5b9b6793c3870604099dbd4b58531e6ac63cb15d.exe

  • Size

    956KB

  • MD5

    1d0f9fe2578b015eba100952a39ded18

  • SHA1

    304e4a2963f5071360a400545cfca885f8e4bcf4

  • SHA256

    5b65b6044cab0bcb44717f5e5b9b6793c3870604099dbd4b58531e6ac63cb15d

  • SHA512

    4625f6655c098b011759f3da8027959ea1987e7d50dfd5364e1a297c0a4b641794579d558c0702a60d729438edfc2ce197accd843564c03ed773ce29696ee3b0

  • SSDEEP

    12288:VaBXDylqDV1ZWtMhzGZ0GEdtARScCbD4AjM/4Kpi3sXsBqRO6PZXcQ6dhFcgAo:VaBelYYAJPARScCbKQN83ROthzA

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fr35

Decoy

kantumusic.com

bswpcll.com

retaketomaxx.store

wyrak.site

chrisdc.com

myepower.net

manuscripttomarket.com

arthvisory.com

licvrb.com

iwacufinance.com

subha.info

jdksy.xyz

cdlyu.com

kinisehat.com

solidrockmultimedia.com

goconcepten48.online

efox8.com

elegantnewlook.com

samalaw-sa.com

otcwl.store

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b65b6044cab0bcb44717f5e5b9b6793c3870604099dbd4b58531e6ac63cb15d.exe
    "C:\Users\Admin\AppData\Local\Temp\5b65b6044cab0bcb44717f5e5b9b6793c3870604099dbd4b58531e6ac63cb15d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Users\Admin\AppData\Local\Temp\5b65b6044cab0bcb44717f5e5b9b6793c3870604099dbd4b58531e6ac63cb15d.exe
      "C:\Users\Admin\AppData\Local\Temp\5b65b6044cab0bcb44717f5e5b9b6793c3870604099dbd4b58531e6ac63cb15d.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:8

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/8-12-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/8-15-0x0000000000F90000-0x00000000012DA000-memory.dmp

    Filesize

    3.3MB

  • memory/2504-6-0x0000000005B60000-0x0000000005B7A000-memory.dmp

    Filesize

    104KB

  • memory/2504-3-0x0000000005860000-0x00000000058F2000-memory.dmp

    Filesize

    584KB

  • memory/2504-4-0x0000000075020000-0x00000000757D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2504-5-0x0000000005900000-0x000000000590A000-memory.dmp

    Filesize

    40KB

  • memory/2504-0-0x000000007502E000-0x000000007502F000-memory.dmp

    Filesize

    4KB

  • memory/2504-7-0x000000007502E000-0x000000007502F000-memory.dmp

    Filesize

    4KB

  • memory/2504-8-0x0000000075020000-0x00000000757D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2504-9-0x0000000008270000-0x000000000830C000-memory.dmp

    Filesize

    624KB

  • memory/2504-10-0x0000000008460000-0x000000000851A000-memory.dmp

    Filesize

    744KB

  • memory/2504-11-0x0000000008520000-0x000000000855C000-memory.dmp

    Filesize

    240KB

  • memory/2504-2-0x0000000005CF0000-0x0000000006294000-memory.dmp

    Filesize

    5.6MB

  • memory/2504-14-0x0000000075020000-0x00000000757D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2504-1-0x0000000000D60000-0x0000000000E56000-memory.dmp

    Filesize

    984KB