Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2024 20:06

General

  • Target

    efb19672e87fabd19381a971af5776394e593b13e3f065f20e4ef8bbfd923177.exe

  • Size

    915KB

  • MD5

    792353205b038d4109dc86fbfaf1836e

  • SHA1

    788fd33360c15eaefe8074d0d67ec3198d028e7e

  • SHA256

    efb19672e87fabd19381a971af5776394e593b13e3f065f20e4ef8bbfd923177

  • SHA512

    5a91c9662e0ea4e9db2ea2046a0b696f0a85c99aa851cda9987ba81c4a0edc92d05862efea481fe50492f44352cb38bb5bd3bb16b2cda20e96a612da68c0c8ec

  • SSDEEP

    12288:jqY3c8/y70cUbrU/4Rj8JIJTcbfdK1rZdnSWBopL/DCn6k6DNwIrqaewt1KgP:Wmx7g/0gJzbfdSDSWBopfC6BD

Malware Config

Extracted

Family

formbook

Campaign

oc5e

Decoy

9gZPW9yJUzcMFJ6KSbk=

kWCy2lf52OGbUmtEHR9i3aOIb8c=

mKKp192P5FQ5p4cxJ8vQyqOIb8c=

5On+xX5s0VE5pruTMQ+5

xs0RFcesYRb5MAHGrTUPz6OIb8c=

m36XWeE+J455493HVQTJfCo=

QtLkoNvKqJ9eJrVmXC7PlSg=

0jiSSgO6GNN7N1jk5A==

aX7BtX5eyln88rZeJKWuY1Hy0g==

tQ9ZEtyxE6FfoLGTMQ+5

MZHXcyvfLOXMCeGPSfKrkCI=

qYzioZQLHKOtY7FH2tltaA==

mH5m/biP4UL5c6uTMQ+5

Qla8f3DYrQy2bocc

iRoQtvLlAFxDv3Me8w==

p+4A7eVNLpeQBPGon3NMCOZXFX9O

WfAzGFQF3jkZk7eTMQ+5

Z7oF0kuvBLNkXBvBgwcNEulXFX9O

KBFnE0PvwOuIlBPBm2OqYA==

alm1creOsHsx7g==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\efb19672e87fabd19381a971af5776394e593b13e3f065f20e4ef8bbfd923177.exe
    "C:\Users\Admin\AppData\Local\Temp\efb19672e87fabd19381a971af5776394e593b13e3f065f20e4ef8bbfd923177.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Users\Admin\AppData\Local\Temp\efb19672e87fabd19381a971af5776394e593b13e3f065f20e4ef8bbfd923177.exe
      "C:\Users\Admin\AppData\Local\Temp\efb19672e87fabd19381a971af5776394e593b13e3f065f20e4ef8bbfd923177.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3948-14-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3948-19-0x00000000017D0000-0x0000000001B1A000-memory.dmp

    Filesize

    3.3MB

  • memory/3948-17-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/4212-8-0x0000000074800000-0x0000000074FB0000-memory.dmp

    Filesize

    7.7MB

  • memory/4212-10-0x00000000064E0000-0x000000000656E000-memory.dmp

    Filesize

    568KB

  • memory/4212-5-0x0000000004E50000-0x0000000004E5A000-memory.dmp

    Filesize

    40KB

  • memory/4212-6-0x0000000005FF0000-0x0000000006004000-memory.dmp

    Filesize

    80KB

  • memory/4212-7-0x000000007480E000-0x000000007480F000-memory.dmp

    Filesize

    4KB

  • memory/4212-0-0x000000007480E000-0x000000007480F000-memory.dmp

    Filesize

    4KB

  • memory/4212-9-0x0000000006290000-0x000000000629C000-memory.dmp

    Filesize

    48KB

  • memory/4212-4-0x0000000074800000-0x0000000074FB0000-memory.dmp

    Filesize

    7.7MB

  • memory/4212-11-0x0000000006630000-0x00000000066CC000-memory.dmp

    Filesize

    624KB

  • memory/4212-12-0x00000000066D0000-0x0000000006736000-memory.dmp

    Filesize

    408KB

  • memory/4212-13-0x00000000065C0000-0x00000000065F4000-memory.dmp

    Filesize

    208KB

  • memory/4212-3-0x0000000004D70000-0x0000000004E02000-memory.dmp

    Filesize

    584KB

  • memory/4212-2-0x0000000005400000-0x00000000059A4000-memory.dmp

    Filesize

    5.6MB

  • memory/4212-18-0x0000000074800000-0x0000000074FB0000-memory.dmp

    Filesize

    7.7MB

  • memory/4212-1-0x00000000002C0000-0x00000000003AA000-memory.dmp

    Filesize

    936KB