Overview

overview

10

Static

static

8

556791.msi

windows7_x64

10

556791.msi

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    07-05-2021 13:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    556791.msi

  • Size

    252KB

  • MD5

    04d6b8269105608ef9a560927dc3a9fa

  • SHA1

    80f9a44457b63b766ce26acfb69676a402c2b838

  • SHA256

    dd3ecf0b5a39b287ba63687fe12ff1f1fcdde34adf0f3e30f7990ebc158347d8

  • SHA512

    5e3b4db37438d9cc3591867ad38d1d7d9c1cb24b13ce2a798a7a1c8627ef64c157241d734067446f3ef4856ca5513db3d61c17ea030bca9361e01fb0fcdb31d2

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.111bjs.com/ccr/

Decoy

abdullahlodhi.com

jevya.com

knoxvillerestaurant.com

mekarauroko7389.com

cricketspowder.net

johannchirinos.com

orangeorganical.com

libero-tt.com

lorenaegianluca.com

wintab.net

modernmillievintage.com

zgdqcyw.com

jeffabildgaardmd.com

nurulfikrimakassar.com

findyourchef.com

innovationsservicegroup.com

destek-taleplerimiz.com

whfqqco.icu

kosmetikmadeingermany.com

dieteticos.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 2 IoCs
    rat
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 6 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Windows\system32\msiexec.exe
      msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\556791.msi
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:856
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Installer\MSID653.tmp"
        3⤵
          PID:2256
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4024
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2272
      • C:\Windows\Installer\MSID653.tmp
        "C:\Windows\Installer\MSID653.tmp"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3888
        • C:\Windows\Installer\MSID653.tmp
          "C:\Windows\Installer\MSID653.tmp"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1172
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1020
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2112

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    2
    T1120

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Installer\MSID653.tmp
      MD5

      2b1cb416ade4d567beae5b90f78881a6

      SHA1

      bb6cfc2f205a922620eeca38406e9ca2ff2875bf

      SHA256

      ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3

      SHA512

      f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09

      Download Submit
    • C:\Windows\Installer\MSID653.tmp
      MD5

      2b1cb416ade4d567beae5b90f78881a6

      SHA1

      bb6cfc2f205a922620eeca38406e9ca2ff2875bf

      SHA256

      ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3

      SHA512

      f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09

      Download Submit
    • C:\Windows\Installer\MSID653.tmp
      MD5

      2b1cb416ade4d567beae5b90f78881a6

      SHA1

      bb6cfc2f205a922620eeca38406e9ca2ff2875bf

      SHA256

      ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3

      SHA512

      f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09

      Download Submit
    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      MD5

      7a3ce4b751b8c62303c890e87789d20a

      SHA1

      404be5b34b4689bbf5c5db26ccce1335187556e9

      SHA256

      296be3ecaf83f0fa678c6d8581f5a0aa001ccf6d73eff01f792a175bba0e294d

      SHA512

      83b3f266b857dc81ae168535fb5941f63069544f26d443e58553e07b55559731154f010803a63eb55cf87752992caabb3b3b6d85333e379755e8225ed1726993

      Download Submit
    • \??\Volume{d05cfc4a-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{77146023-2bf5-4268-a102-bf65f936e9a2}_OnDiskSnapshotProp
      MD5

      4ba08a1c5584c6e8a702f69b33285abf

      SHA1

      50d0072fc120fd641e8b4588c20b470c161602a4

      SHA256

      6d7bcd2dfc0b28aeef9eb48ed098b91fb29c00afa7b4957e9cc83b2fb4321e95

      SHA512

      c172b5609c8ce6795e1ad547422f3612ea0cda49f9475f8f68b2719a788025232ce8c0ca7f37158b8cceb877f216e14f517842f59a0c651f14d0f05bbc569557

      Download Submit
    • \Users\Admin\AppData\Local\Temp\nseDC5D.tmp\ie2mi.dll
      MD5

      7795b5a3842f3220526b9b5c0792c91a

      SHA1

      69d6e1a264aab15d749a70a74d63de59c266e3b4

      SHA256

      7d931a93e761686bde7d6a79253cb03378ee28f8d12c683a9017540e798d2988

      SHA512

      45bf7270aee9e4ccbd84107490469e455ac4bc6faac7e1aff9cc4453c9c07afc8e64dbef955e248116d28f49b51f6596812d8366ed057ddc73ab061aecfcc43e

      Download Submit
    • memory/1060-130-0x0000000000000000-mapping.dmp
      Download
    • memory/1060-137-0x0000000004220000-0x00000000042B3000-memory.dmp
      Filesize

      588KB

      Download
    • memory/1060-134-0x00000000043B0000-0x00000000046D0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/1060-132-0x0000000000130000-0x0000000000136000-memory.dmp
      Filesize

      24KB

      Download
    • memory/1060-133-0x0000000002950000-0x000000000297E000-memory.dmp
      Filesize

      184KB

      Download
    • memory/1172-123-0x000000000041EBB0-mapping.dmp
      Download
    • memory/1172-128-0x0000000000DF0000-0x0000000000E04000-memory.dmp
      Filesize

      80KB

      Download
    • memory/1172-127-0x00000000009E0000-0x0000000000D00000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/1172-126-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

      Download
    • memory/2256-131-0x0000000000000000-mapping.dmp
      Download
    • memory/2272-118-0x0000000000000000-mapping.dmp
      Download
    • memory/3056-129-0x0000000003290000-0x0000000003377000-memory.dmp
      Filesize

      924KB

      Download
    • memory/3056-138-0x0000000006A40000-0x0000000006AF6000-memory.dmp
      Filesize

      728KB

      Download
    • memory/3888-125-0x0000000000B00000-0x0000000000B02000-memory.dmp
      Filesize

      8KB

      Download
    • memory/3888-119-0x0000000000000000-mapping.dmp
      Download