Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29-12-2024 23:50

General

  • Target

    b7ab1380649d7f31d577bd69980baf9d97274c95fab12936befd6c3aa12b7fc3.exe

  • Size

    734KB

  • MD5

    9c742946914ed5e32ddd328e3d6419b9

  • SHA1

    c59521d2681504beed0a5a692119471ef3cd5643

  • SHA256

    b7ab1380649d7f31d577bd69980baf9d97274c95fab12936befd6c3aa12b7fc3

  • SHA512

    b0e88c7ab34a34574ef6c688c703b03e4744ba1fb8edb2bda488dab920b892223d39dfab41f4828772dcec4ed5a2ad6000de55437f77285347fc980e9f6786f7

  • SSDEEP

    6144:Z2WvsajJQNh2B0B66GfLIG51eHmNIRT0yPluQaGgZdbCSj2Z152TnsU9OrXLRxIl:x4A0B7ysmOT/luwgZ1iZ1Ks9rRtaiK

Malware Config

Extracted

Family

formbook

Campaign

cqd8

Decoy

9zPItsSBQPthH0B1

iyz2ugC7TUMEaZEDDTNIzw==

uVc25zCFO03zbYzHxXLElk5HHccFoes=

RYDZw1su7yszucXjwqtgrz1tSccFoes=

AiB+KfBdDLRFs8sOAsmAllKZeg==

w5T7/Y1lNGBeMdKkKNl8tUl3fTWjlURG

mcIHqPCaEavSyg==

YA7dyN6xKf1MKJa/RA==

Dt789IRVd/fO8FeQNOiV3g==

jYfu3dS4b/1OL59exnPPEo4=

SjyOSKD6lRhpWwUmMwE8ncB1KOg=

JIT782/TaO41DXw3hYJa1g==

uT4u7SwA+3yA/iCo0O7tHyeffA==

/gJzPfngDySzwndmyHPPEo4=

+Um8wD7b9bCQ8A9cK4Nl1oA=

RaikVqx5ozxW3vd6khgIHsDMgKrv

hyYEyRMIEJ8WdnFePeLgHyeffA==

bCov6raFJ30odm5fJQQ=

1rMMrXrTf7OZqyLVM708wZ0=

U4nspOC6sJ3et2I=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7ab1380649d7f31d577bd69980baf9d97274c95fab12936befd6c3aa12b7fc3.exe
    "C:\Users\Admin\AppData\Local\Temp\b7ab1380649d7f31d577bd69980baf9d97274c95fab12936befd6c3aa12b7fc3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\AppData\Local\Temp\b7ab1380649d7f31d577bd69980baf9d97274c95fab12936befd6c3aa12b7fc3.exe
      "C:\Users\Admin\AppData\Local\Temp\b7ab1380649d7f31d577bd69980baf9d97274c95fab12936befd6c3aa12b7fc3.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1668-8-0x00000000006E0000-0x0000000000714000-memory.dmp

    Filesize

    208KB

  • memory/1668-4-0x00000000744DE000-0x00000000744DF000-memory.dmp

    Filesize

    4KB

  • memory/1668-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

    Filesize

    4KB

  • memory/1668-3-0x00000000004F0000-0x0000000000504000-memory.dmp

    Filesize

    80KB

  • memory/1668-18-0x00000000744D0000-0x0000000074BBE000-memory.dmp

    Filesize

    6.9MB

  • memory/1668-5-0x00000000744D0000-0x0000000074BBE000-memory.dmp

    Filesize

    6.9MB

  • memory/1668-6-0x0000000000540000-0x000000000054C000-memory.dmp

    Filesize

    48KB

  • memory/1668-7-0x00000000056D0000-0x000000000575E000-memory.dmp

    Filesize

    568KB

  • memory/1668-2-0x00000000744D0000-0x0000000074BBE000-memory.dmp

    Filesize

    6.9MB

  • memory/1668-1-0x0000000000B10000-0x0000000000BCE000-memory.dmp

    Filesize

    760KB

  • memory/2844-15-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2844-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2844-17-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2844-10-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2844-11-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2844-19-0x0000000000BD0000-0x0000000000ED3000-memory.dmp

    Filesize

    3.0MB

  • memory/2844-20-0x0000000000BD0000-0x0000000000ED3000-memory.dmp

    Filesize

    3.0MB