Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    24-06-2024 01:31

General

  • Target

    Salary raise.exe

  • Size

    1.1MB

  • MD5

    c8d850146b27ea87e5242f103088ef2d

  • SHA1

    b7425314a1dd4316e2e7038d8cbf6a0a41804855

  • SHA256

    bd8a38d06603be4dafa830f2a5faa9f55b3e24cb692314908dc246adad8c8999

  • SHA512

    c2eaf840856f613cf7e71dbba6f5112c1b09c40cd3b7328322b27a3092229b125230264f7b2db6360bb285a65290d372ec23e74a91f11a10f3e15c2cef285f02

  • SSDEEP

    24576:eAHnh+eWsN3skA4RV1Hom2KXMmHa6ZAXd/HGOeb7r5:Jh+ZkldoPK8Ya6ZAXd/mlbR

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

as02

Decoy

qwin777.com

robinhoods.live

h3jh-dal.pics

braindeadcopywriting.com

kktcbet1000.com

mpo0463.cfd

raboteshoes.com

ab1718.com

lowcrusiers.com

gregcopelandmusic.com

dkfndch.store

firstclassuni.com

00ewu1ub.com

shunweichemical.com

sugarits.com

marqify.com

mistmajik.com

trezip.online

tinytables.xyz

suestergocoaching.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Users\Admin\AppData\Local\Temp\Salary raise.exe
      "C:\Users\Admin\AppData\Local\Temp\Salary raise.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2200
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\Salary raise.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2840
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
          PID:2752

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1344-23-0x0000000004A30000-0x0000000004AFF000-memory.dmp
      Filesize

      828KB

    • memory/1344-31-0x0000000004EB0000-0x0000000004FE2000-memory.dmp
      Filesize

      1.2MB

    • memory/1344-28-0x0000000004EB0000-0x0000000004FE2000-memory.dmp
      Filesize

      1.2MB

    • memory/1344-27-0x0000000004EB0000-0x0000000004FE2000-memory.dmp
      Filesize

      1.2MB

    • memory/1344-16-0x00000000036B0000-0x00000000037B0000-memory.dmp
      Filesize

      1024KB

    • memory/1344-17-0x0000000004A30000-0x0000000004AFF000-memory.dmp
      Filesize

      828KB

    • memory/2200-10-0x00000000000B0000-0x00000000000B4000-memory.dmp
      Filesize

      16KB

    • memory/2840-14-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/2840-15-0x0000000000180000-0x0000000000195000-memory.dmp
      Filesize

      84KB

    • memory/2840-12-0x0000000000990000-0x0000000000C93000-memory.dmp
      Filesize

      3.0MB

    • memory/2840-11-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/3044-19-0x0000000000A90000-0x0000000000AAC000-memory.dmp
      Filesize

      112KB

    • memory/3044-20-0x0000000000080000-0x00000000000AF000-memory.dmp
      Filesize

      188KB

    • memory/3044-18-0x0000000000A90000-0x0000000000AAC000-memory.dmp
      Filesize

      112KB