Analysis

  • max time kernel
    145s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2024 18:33

General

  • Target

    19.10.2022-21.10.2022 Ekstre.exe

  • Size

    254KB

  • MD5

    acb287f5d33a3bec62620ef511cd3e6a

  • SHA1

    975cec902942585321f353e27d41f7dc4bf5b1f5

  • SHA256

    622fcde32b89e9dce35b3513aec205891045470cb1111cf1c88f939cd10065fb

  • SHA512

    8041d5d84098881f1051b66322726ef79718334b766e062b139ed11cfdd622c1b498e110954cd56af74bdefda40b676afb496f4b2c3264dc44384fb64221d23e

  • SSDEEP

    6144:mbE/HUbHvDIgYx2yMlMdhpE63mj1CRK/dt1ImTXfGaW9:mb/HMylMdhnWj1C/WM9

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

oy10

Decoy

wzwanju.com

vaultnutrition.info

propane-gallon.site

balkanmetin2.com

costa-del-sol.email

kayodeokikiolu.com

singlesshirts.com

nearestfoods.com

trenddetail.com

yihaimaidan.net

dfdr3r.site

tuitionmatters.co.uk

benglas.online

coloraja.xyz

tianzicheng.com

lamkt.com

dileca.com

6698856.com

vishi.store

ablehair.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Users\Admin\AppData\Local\Temp\19.10.2022-21.10.2022 Ekstre.exe
      "C:\Users\Admin\AppData\Local\Temp\19.10.2022-21.10.2022 Ekstre.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Users\Admin\AppData\Local\Temp\oujsjnpvzn.exe
        "C:\Users\Admin\AppData\Local\Temp\oujsjnpvzn.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Users\Admin\AppData\Local\Temp\oujsjnpvzn.exe
          "C:\Users\Admin\AppData\Local\Temp\oujsjnpvzn.exe"
          4⤵
          • Executes dropped EXE
          PID:2912
        • C:\Users\Admin\AppData\Local\Temp\oujsjnpvzn.exe
          "C:\Users\Admin\AppData\Local\Temp\oujsjnpvzn.exe"
          4⤵
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2696
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\oujsjnpvzn.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dgnetfwgwxi.n

    Filesize

    4KB

    MD5

    df0d19c758434ec79b2df3ed6b051a63

    SHA1

    46d2da8bfccfe08abe80ca3b061d8fb2dcceed69

    SHA256

    f4db6669e8ee95be76030c8bc895c8dd91897afe74af9a3c2a90dd098ede89ae

    SHA512

    7091c98f0b86e6db0640a7751778e283a523be1ad5e174c2a74ea4c92e4b92c4f042317c32fa751764ecca94a55dd097aa769aab563e4f9b4a13373e7fdbf5ee

  • C:\Users\Admin\AppData\Local\Temp\xpjzddy.csv

    Filesize

    185KB

    MD5

    a673c10951267a6553631dace3a24cfb

    SHA1

    07f38a7a0ea1c4677c62fb85e6fb758875c0089b

    SHA256

    4fe1118d5bcb9ae4cb1204f4d411e792516b48c341a65c7d7a7e742560e379f3

    SHA512

    c7035f44a84398ce2d2668322efc950a838daefb2ef2ce6b6b007470a7347ad0ac62e99883a090c7ef20d93fdf7ab6bcaa42bd19152068808b966bd92d6123cf

  • \Users\Admin\AppData\Local\Temp\oujsjnpvzn.exe

    Filesize

    58KB

    MD5

    a53bf35dd3f2a0ece1babdf99d98ddb7

    SHA1

    866e4d1315486d4f792e03449def24bf48fba2f5

    SHA256

    f27f1c46335ed31550b8fd38781e85fd498edaf77ffc7fdea7b32f044c5cc26d

    SHA512

    f0ea778f032871260b891116e880c1814a7eeb512b4f649c8a3d355109aed9858128477a8d2c1d12dac5ace5be74879dfd590b9959c309ce67d1879828f679f2

  • memory/1184-32-0x0000000006A80000-0x0000000006B71000-memory.dmp

    Filesize

    964KB

  • memory/1184-30-0x0000000006A80000-0x0000000006B71000-memory.dmp

    Filesize

    964KB

  • memory/1184-29-0x0000000006A80000-0x0000000006B71000-memory.dmp

    Filesize

    964KB

  • memory/1184-25-0x0000000006710000-0x0000000006831000-memory.dmp

    Filesize

    1.1MB

  • memory/1184-20-0x0000000006710000-0x0000000006831000-memory.dmp

    Filesize

    1.1MB

  • memory/2244-22-0x0000000000780000-0x00000000007A2000-memory.dmp

    Filesize

    136KB

  • memory/2244-23-0x0000000000780000-0x00000000007A2000-memory.dmp

    Filesize

    136KB

  • memory/2244-24-0x0000000000070000-0x000000000009F000-memory.dmp

    Filesize

    188KB

  • memory/2696-18-0x000000000041F000-0x0000000000420000-memory.dmp

    Filesize

    4KB

  • memory/2696-19-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2696-17-0x00000000008D0000-0x0000000000BD3000-memory.dmp

    Filesize

    3.0MB

  • memory/2712-9-0x0000000000100000-0x0000000000102000-memory.dmp

    Filesize

    8KB