Overview

overview

10

Static

static

8

SecuriteIn...42.msi

windows7_x64

10

SecuriteIn...42.msi

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    07-05-2021 16:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Gen.Variant.Androm.29.22420.16142.msi

  • Size

    252KB

  • MD5

    04d6b8269105608ef9a560927dc3a9fa

  • SHA1

    80f9a44457b63b766ce26acfb69676a402c2b838

  • SHA256

    dd3ecf0b5a39b287ba63687fe12ff1f1fcdde34adf0f3e30f7990ebc158347d8

  • SHA512

    5e3b4db37438d9cc3591867ad38d1d7d9c1cb24b13ce2a798a7a1c8627ef64c157241d734067446f3ef4856ca5513db3d61c17ea030bca9361e01fb0fcdb31d2

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.111bjs.com/ccr/

Decoy

abdullahlodhi.com

jevya.com

knoxvillerestaurant.com

mekarauroko7389.com

cricketspowder.net

johannchirinos.com

orangeorganical.com

libero-tt.com

lorenaegianluca.com

wintab.net

modernmillievintage.com

zgdqcyw.com

jeffabildgaardmd.com

nurulfikrimakassar.com

findyourchef.com

innovationsservicegroup.com

destek-taleplerimiz.com

whfqqco.icu

kosmetikmadeingermany.com

dieteticos.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 3 IoCs
    rat
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 6 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Windows\system32\msiexec.exe
      msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Androm.29.22420.16142.msi
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4024
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2308
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Installer\MSI75A5.tmp"
        3⤵
          PID:2184
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2660
      • C:\Windows\Installer\MSI75A5.tmp
        "C:\Windows\Installer\MSI75A5.tmp"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\Installer\MSI75A5.tmp
          "C:\Windows\Installer\MSI75A5.tmp"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:3704
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:200
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1220

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    2
    T1120

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Installer\MSI75A5.tmp
      MD5

      2b1cb416ade4d567beae5b90f78881a6

      SHA1

      bb6cfc2f205a922620eeca38406e9ca2ff2875bf

      SHA256

      ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3

      SHA512

      f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09

      Download Submit
    • C:\Windows\Installer\MSI75A5.tmp
      MD5

      2b1cb416ade4d567beae5b90f78881a6

      SHA1

      bb6cfc2f205a922620eeca38406e9ca2ff2875bf

      SHA256

      ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3

      SHA512

      f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09

      Download Submit
    • C:\Windows\Installer\MSI75A5.tmp
      MD5

      2b1cb416ade4d567beae5b90f78881a6

      SHA1

      bb6cfc2f205a922620eeca38406e9ca2ff2875bf

      SHA256

      ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3

      SHA512

      f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09

      Download Submit
    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      MD5

      427ee2ad399296dbec5ec34d6fa33452

      SHA1

      985a596c79cf3e09cf44d6229c16fd6c05ff53d1

      SHA256

      4ea86b55f3e34efe3c8a9f2803a58aa1360bca2ef2972b6cc1374674cadf598d

      SHA512

      846b3983c698e92d55e731b1156d23a2e1d4ad7ad8a087fec72ff7222733500e006a30223ccb4843642ad2541ae38e7f4286159249e2066e9e97fa4b0a245784

      Download Submit
    • \??\Volume{d05cfc4a-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{07fb5ceb-9568-4d4c-a0d6-73132f255eb0}_OnDiskSnapshotProp
      MD5

      4abc2aa30677a150567dc330f7c90443

      SHA1

      8163f55d5a8d97a252020a43b6d041b1a34b477d

      SHA256

      318bd5746f1e1673ad443afe089532066e2c5e7887c09d2122005130d25a880b

      SHA512

      7c77223b30dc2996d110d40d976d5bfb8a5d6f62cba42d17d8c16db2b30c6aed916b327777423ddd92642118c8d9be55d788aadc675c8114e462834d4057cdfc

      Download Submit
    • \Users\Admin\AppData\Local\Temp\nsb7C7A.tmp\ie2mi.dll
      MD5

      7795b5a3842f3220526b9b5c0792c91a

      SHA1

      69d6e1a264aab15d749a70a74d63de59c266e3b4

      SHA256

      7d931a93e761686bde7d6a79253cb03378ee28f8d12c683a9017540e798d2988

      SHA512

      45bf7270aee9e4ccbd84107490469e455ac4bc6faac7e1aff9cc4453c9c07afc8e64dbef955e248116d28f49b51f6596812d8366ed057ddc73ab061aecfcc43e

      Download Submit
    • memory/2184-133-0x0000000000000000-mapping.dmp
      Download
    • memory/2308-134-0x00000000009B0000-0x00000000009C7000-memory.dmp
      Filesize

      92KB

      Download
    • memory/2308-137-0x00000000031C0000-0x0000000003253000-memory.dmp
      Filesize

      588KB

      Download
    • memory/2308-136-0x0000000002D00000-0x0000000002DAE000-memory.dmp
      Filesize

      696KB

      Download
    • memory/2308-132-0x0000000000000000-mapping.dmp
      Download
    • memory/2308-135-0x0000000002CD0000-0x0000000002CFE000-memory.dmp
      Filesize

      184KB

      Download
    • memory/2660-118-0x0000000000000000-mapping.dmp
      Download
    • memory/2876-119-0x0000000000000000-mapping.dmp
      Download
    • memory/2876-125-0x00000000028B0000-0x00000000028B2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/3024-138-0x0000000006050000-0x0000000006138000-memory.dmp
      Filesize

      928KB

      Download
    • memory/3024-131-0x00000000063D0000-0x000000000656F000-memory.dmp
      Filesize

      1.6MB

      Download
    • memory/3704-128-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

      Download
    • memory/3704-130-0x00000000004D0000-0x000000000057E000-memory.dmp
      Filesize

      696KB

      Download
    • memory/3704-129-0x0000000000AA0000-0x0000000000DC0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/3704-126-0x000000000041EBB0-mapping.dmp
      Download