Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2024 20:43

General

  • Target

    textview66547.exe

  • Size

    1.3MB

  • MD5

    734282c3d93555760ee7347318299aa1

  • SHA1

    d17be364c71e18e647ad260f4d4f747996b7a753

  • SHA256

    38b573288a18231b62b0fe72ca5ea36f6d20303ce7658d82487523488399955b

  • SHA512

    e02b026077d13c57f4dfc6c74a06cd5f0d59213c37113e57b44915c97d20f767350feda8780d9138cde953430b88f9c20ec601cdeb3c4984483c9c4f446f9249

  • SSDEEP

    24576:iAOcZXp0bR4ZPmjscttv8MnhoUkjPV99npuezy71oporahyR6:ofR4MQcttv8MhoUkj9fZe6GRU

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

t01w

Decoy

yeluzishiyanshi.com

thehardtech.xyz

arrowheadk8.site

zaulkunutila.xyz

lookastro.net

congregorecruitment.co.uk

darcyboo.uk

collettesbet.net

ltgpd.com

hiddenapphq.net

haxtrl.online

esenbook.com

jxzyyx.com

ulvabuyout.xyz

instashop.life

vazra.top

ewdvatcuce4.top

zhishi68.com

fabricsandfashion.com

hootcaster.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Users\Admin\AppData\Local\Temp\textview66547.exe
      "C:\Users\Admin\AppData\Local\Temp\textview66547.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Users\Admin\5_86\sogmqlr.pif
        "C:\Users\Admin\5_86\sogmqlr.pif" eiifenbgm.fmk
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          4⤵
            PID:2516
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            4⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:1256
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\SysWOW64\cmd.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4764
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2884

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\5_86\cigds.jpg

      Filesize

      45KB

      MD5

      a85785f3dd5d27c21cdcf9deffb85b4f

      SHA1

      dc4615334c2f6a2dbdbd376de6e5b9fb4c400a66

      SHA256

      7a089d4a4c799ce9e9f5e75f89815f065af3f83a8a9ed73566844a8ea910f30d

      SHA512

      a9a4e3b41121f5a2412dcf05d4fd8162036590152838221dc8811e18fc47888a4d09a83894cfb00f593cb7cd9eed6f901b6fa523fd222bca170fbfd966e130ae

    • C:\Users\Admin\5_86\pdvraobar.okg

      Filesize

      370KB

      MD5

      f5e2ba30a45201d12f28c47cc71919cc

      SHA1

      1dd97af07f03e87f26bc6012cde97855e7ae40da

      SHA256

      d3f446c8cd06efa9b89bdcfe33d8b84831ab1e04353837d4de1348076ab3fd15

      SHA512

      3c81ab2c7c598c7f468bac9a0a8c0b64f6e66b67f1d5786ffa9b3f0926b1704c841850dde0bf68da58a429503bca5cb0b03a981287de68a845638f6399ece513

    • C:\Users\Admin\5_86\sogmqlr.pif

      Filesize

      1.7MB

      MD5

      dd3466f64841cf21fc31f63f03dbfd29

      SHA1

      3878c8e52203d792c6f672595f7c78ab27ce3f04

      SHA256

      4fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b

      SHA512

      adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057

    • memory/1256-63-0x0000000001420000-0x0000000001435000-memory.dmp

      Filesize

      84KB

    • memory/1256-60-0x0000000001920000-0x0000000001C6A000-memory.dmp

      Filesize

      3.3MB

    • memory/1256-62-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1256-59-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3444-64-0x0000000002A40000-0x0000000002AFC000-memory.dmp

      Filesize

      752KB

    • memory/3444-69-0x0000000002A40000-0x0000000002AFC000-memory.dmp

      Filesize

      752KB

    • memory/3444-74-0x0000000002DC0000-0x0000000002EA7000-memory.dmp

      Filesize

      924KB

    • memory/4764-67-0x00000000006F0000-0x000000000074A000-memory.dmp

      Filesize

      360KB

    • memory/4764-65-0x00000000006F0000-0x000000000074A000-memory.dmp

      Filesize

      360KB

    • memory/4764-68-0x00000000011C0000-0x00000000011EF000-memory.dmp

      Filesize

      188KB