Analysis

  • max time kernel
    150s
  • max time network
    182s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    12-10-2021 15:40

General

  • Target

    Payment Advise.xlsx

  • Size

    337KB

  • MD5

    2a2774f89f6ac878975ef5227cc8a92b

  • SHA1

    bfbfd645fed06b7598bfe1f583d0ba04ad943b29

  • SHA256

    54167fce5b8273b4a21f9da96c32113ebe3e5831f51aebad3ae1e97d5165f263

  • SHA512

    58faad098728b89d6e99ee6e240846b04a35047e317791a47905cd2a6117a487e9ae9a6ab6d33d1405c6be4e7cdc71b18c512929c92ed3910b8554ffe13e929d

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Advise.xlsx"
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1980
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Public\vbc.exe"
        3⤵
          PID:1664
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1112
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          PID:864
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          PID:816
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:112

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Exploitation for Client Execution

    1
    T1203

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\vbc.exe
      MD5

      1fe73fe4d37cae6a02262b5164f3def0

      SHA1

      80b03eb27651723bded1fd1425f489225b3bba3b

      SHA256

      0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

      SHA512

      7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

    • C:\Users\Public\vbc.exe
      MD5

      1fe73fe4d37cae6a02262b5164f3def0

      SHA1

      80b03eb27651723bded1fd1425f489225b3bba3b

      SHA256

      0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

      SHA512

      7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

    • C:\Users\Public\vbc.exe
      MD5

      1fe73fe4d37cae6a02262b5164f3def0

      SHA1

      80b03eb27651723bded1fd1425f489225b3bba3b

      SHA256

      0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

      SHA512

      7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

    • C:\Users\Public\vbc.exe
      MD5

      1fe73fe4d37cae6a02262b5164f3def0

      SHA1

      80b03eb27651723bded1fd1425f489225b3bba3b

      SHA256

      0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

      SHA512

      7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

    • C:\Users\Public\vbc.exe
      MD5

      1fe73fe4d37cae6a02262b5164f3def0

      SHA1

      80b03eb27651723bded1fd1425f489225b3bba3b

      SHA256

      0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

      SHA512

      7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

    • \Users\Public\vbc.exe
      MD5

      1fe73fe4d37cae6a02262b5164f3def0

      SHA1

      80b03eb27651723bded1fd1425f489225b3bba3b

      SHA256

      0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

      SHA512

      7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

    • \Users\Public\vbc.exe
      MD5

      1fe73fe4d37cae6a02262b5164f3def0

      SHA1

      80b03eb27651723bded1fd1425f489225b3bba3b

      SHA256

      0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

      SHA512

      7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

    • \Users\Public\vbc.exe
      MD5

      1fe73fe4d37cae6a02262b5164f3def0

      SHA1

      80b03eb27651723bded1fd1425f489225b3bba3b

      SHA256

      0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

      SHA512

      7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

    • \Users\Public\vbc.exe
      MD5

      1fe73fe4d37cae6a02262b5164f3def0

      SHA1

      80b03eb27651723bded1fd1425f489225b3bba3b

      SHA256

      0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

      SHA512

      7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

    • memory/112-79-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/112-78-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/112-88-0x00000000001E0000-0x00000000001F4000-memory.dmp
      Filesize

      80KB

    • memory/112-87-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/112-85-0x0000000000180000-0x0000000000194000-memory.dmp
      Filesize

      80KB

    • memory/112-84-0x0000000000AC0000-0x0000000000DC3000-memory.dmp
      Filesize

      3.0MB

    • memory/112-81-0x000000000041EB80-mapping.dmp
    • memory/112-80-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/900-90-0x0000000000000000-mapping.dmp
    • memory/900-95-0x0000000001F70000-0x0000000002003000-memory.dmp
      Filesize

      588KB

    • memory/900-91-0x00000000006F0000-0x0000000000712000-memory.dmp
      Filesize

      136KB

    • memory/900-92-0x0000000000070000-0x000000000009E000-memory.dmp
      Filesize

      184KB

    • memory/900-94-0x0000000002110000-0x0000000002413000-memory.dmp
      Filesize

      3.0MB

    • memory/1004-62-0x00000000767B1000-0x00000000767B3000-memory.dmp
      Filesize

      8KB

    • memory/1112-67-0x0000000000000000-mapping.dmp
    • memory/1112-75-0x0000000004970000-0x00000000049C0000-memory.dmp
      Filesize

      320KB

    • memory/1112-74-0x0000000000260000-0x0000000000265000-memory.dmp
      Filesize

      20KB

    • memory/1112-73-0x0000000000550000-0x0000000000551000-memory.dmp
      Filesize

      4KB

    • memory/1112-70-0x0000000000A40000-0x0000000000A41000-memory.dmp
      Filesize

      4KB

    • memory/1224-89-0x00000000076A0000-0x000000000783D000-memory.dmp
      Filesize

      1.6MB

    • memory/1224-86-0x0000000006210000-0x0000000006340000-memory.dmp
      Filesize

      1.2MB

    • memory/1224-96-0x0000000005FD0000-0x0000000006107000-memory.dmp
      Filesize

      1.2MB

    • memory/1664-93-0x0000000000000000-mapping.dmp
    • memory/1980-59-0x000000002FED1000-0x000000002FED4000-memory.dmp
      Filesize

      12KB

    • memory/1980-60-0x0000000071851000-0x0000000071853000-memory.dmp
      Filesize

      8KB

    • memory/1980-61-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1980-97-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB