Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-12-2024 01:38
General
-
Target
Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe
-
Size
841KB
-
MD5
42d33f1103e99970b5a2bd66cc7abacf
-
SHA1
18b40de46605a148bd005f07f1396ea4be30f962
-
SHA256
898019809aff31148304abc19ab0514838d5ed4ae75318fe8865b4e5b139d52f
-
SHA512
471ef7e285ae5bb0db67e6722dde3877180d980f1cef271bf81e8c1f8c3fbd26ffa435eb04b0ef14ae6898ac26ed8b235eb9b203947aa4020955e5989e22fbbc
-
SSDEEP
12288:Duup9hCcfZ/2Yp45XWCPrpLlafo3arpcYVx1Izq+lG/hS2zG9+aw9cNq0p2W:qrk/2Yp4JWKmhpcewu+lghjZqN
Malware Config
Extracted
formbook
4.1
wk31
soroban.xyz
irfirstaid.com
irsaycollection.com
thebardownstairsasheville.com
facebookmeta.business
paypalsupportclient.com
metaversusfacebook.com
litakparuikamazon.com
rivianmotorcompany.com
metaversepro.us
ikramfamilypractice.com
bitcoinfuturesetfs.online
5donline.com
rosemount.us
nicole-steinfort.com
performanceautorepairsj.com
scrabblecheats.us
kjg67amazon.com
formerlyknownasfacebook.com
youtubeandgooglepay.online
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Formbook payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
-
Filesize
84KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
48KB
-
Filesize
5.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
368KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
864KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
856KB
-
Filesize
856KB
-
Filesize
856KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
188KB