Analysis

  • max time kernel
    144s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    21-10-2021 18:41

General

  • Target

    61f55bceba5b9a52c750555d62fc7ae9.exe

  • Size

    973KB

  • MD5

    61f55bceba5b9a52c750555d62fc7ae9

  • SHA1

    57f083ea441e1a67c2c1a99d264474ee49388fe7

  • SHA256

    7080315530bc6d7ead65034c1587e4596d9dbf0fc17107fbb28f84bf016009f9

  • SHA512

    f7f00c594d03a73dd8b3c85df4a2ad17aac0fab0ab274ac08ee5dadb51218ce49ec7c89f8feaf0805a49fd8f11abbf29a0d397a248467d4f17fda37290dd9712

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

og2w

C2

http://www.wakecountyrealtyexpert.com/og2w/

Decoy

patriotxf.com

thecreagles.com

riverdenim.com

cybqo.com

zzfangnan.com

empowerhis.com

resiliencewearmiami.com

myticketly.com

pistachio.land

13055.club

millennialsofacertainage.com

jnxdsgc.com

pixelsandplastic.digital

bugroster.com

chargedockz.com

gzyazsp.com

sintec-consultores.com

pourtonmobile.com

upmhss.com

amkanalrajhi.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\61f55bceba5b9a52c750555d62fc7ae9.exe
      "C:\Users\Admin\AppData\Local\Temp\61f55bceba5b9a52c750555d62fc7ae9.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1336
      • C:\Windows\SysWOW64\logagent.exe
        C:\Windows\System32\logagent.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1516
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Public\Trast.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1528
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1904
          • C:\Windows\SysWOW64\reg.exe
            reg delete hkcu\Environment /v windir /f
            5⤵
            • Modifies registry key
            PID:1340
          • C:\Windows\SysWOW64\reg.exe
            reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
            5⤵
            • Modifies registry key
            PID:1540
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
            5⤵
              PID:1840
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Public\nest.bat" "
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1040
          • C:\Windows\SysWOW64\reg.exe
            reg delete hkcu\Environment /v windir /f
            4⤵
            • Modifies registry key
            PID:1568
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:1712
        • C:\Windows\SysWOW64\wuapp.exe
          "C:\Windows\SysWOW64\wuapp.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1692
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            3⤵
              PID:1676

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Defense Evasion

        Modify Registry

        3
        T1112

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\64787901\647logim.jpeg
          MD5

          2fb818958d72dadb18408f05a230c954

          SHA1

          5b7b67454a108e492cc9d23f4ed20d257487e489

          SHA256

          8373ef8086eb7643792228ea511431e9ba08703c84d2f213248d210db5169fd9

          SHA512

          944f378a093c828ecc9eead7387b12dad84d4588ca0a8896fee569dce29057dc94a83cc1434311eb4f08722288c9b4bd8c54f8fe07fef63eb1d03af0b3b21226

        • C:\Users\Admin\AppData\Roaming\64787901\647logrf.ini
          MD5

          2f245469795b865bdd1b956c23d7893d

          SHA1

          6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

          SHA256

          1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

          SHA512

          909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

        • C:\Users\Admin\AppData\Roaming\64787901\647logri.ini
          MD5

          d63a82e5d81e02e399090af26db0b9cb

          SHA1

          91d0014c8f54743bba141fd60c9d963f869d76c9

          SHA256

          eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

          SHA512

          38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

        • C:\Users\Admin\AppData\Roaming\64787901\647logrv.ini
          MD5

          ba3b6bc807d4f76794c4b81b09bb9ba5

          SHA1

          24cb89501f0212ff3095ecc0aba97dd563718fb1

          SHA256

          6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507

          SHA512

          ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf

        • C:\Users\Public\Trast.bat
          MD5

          4068c9f69fcd8a171c67f81d4a952a54

          SHA1

          4d2536a8c28cdcc17465e20d6693fb9e8e713b36

          SHA256

          24222300c78180b50ed1f8361ba63cb27316ec994c1c9079708a51b4a1a9d810

          SHA512

          a64f9319acc51fffd0491c74dcd9c9084c2783b82f95727e4bfe387a8528c6dcf68f11418e88f1e133d115daf907549c86dd7ad866b2a7938add5225fbb2811d

        • C:\Users\Public\UKO.bat
          MD5

          eaf8d967454c3bbddbf2e05a421411f8

          SHA1

          6170880409b24de75c2dc3d56a506fbff7f6622c

          SHA256

          f35f2658455a2e40f151549a7d6465a836c33fa9109e67623916f889849eac56

          SHA512

          fe5be5c673e99f70c93019d01abb0a29dd2ecf25b2d895190ff551f020c28e7d8f99f65007f440f0f76c5bcac343b2a179a94d190c938ea3b9e1197890a412e9

        • C:\Users\Public\nest.bat
          MD5

          8ada51400b7915de2124baaf75e3414c

          SHA1

          1a7b9db12184ab7fd7fce1c383f9670a00adb081

          SHA256

          45aa3957c29865260a78f03eef18ae9aebdbf7bea751ecc88be4a799f2bb46c7

          SHA512

          9afc138157a4565294ca49942579cdb6f5d8084e56f9354738de62b585f4c0fa3e7f2cbc9541827f2084e3ff36c46eed29b46f5dd2444062ffcd05c599992e68

        • memory/1040-80-0x0000000000000000-mapping.dmp
        • memory/1284-84-0x0000000006110000-0x00000000061EB000-memory.dmp
          Filesize

          876KB

        • memory/1284-74-0x0000000007120000-0x000000000722B000-memory.dmp
          Filesize

          1.0MB

        • memory/1336-55-0x0000000000220000-0x0000000000221000-memory.dmp
          Filesize

          4KB

        • memory/1336-57-0x0000000076231000-0x0000000076233000-memory.dmp
          Filesize

          8KB

        • memory/1336-56-0x0000000000241000-0x0000000000255000-memory.dmp
          Filesize

          80KB

        • memory/1340-66-0x0000000000000000-mapping.dmp
        • memory/1516-71-0x0000000072480000-0x00000000724AF000-memory.dmp
          Filesize

          188KB

        • memory/1516-72-0x0000000001FD0000-0x00000000022D3000-memory.dmp
          Filesize

          3.0MB

        • memory/1516-73-0x0000000000210000-0x0000000000224000-memory.dmp
          Filesize

          80KB

        • memory/1516-70-0x0000000000090000-0x0000000000091000-memory.dmp
          Filesize

          4KB

        • memory/1516-58-0x0000000072480000-0x00000000724AF000-memory.dmp
          Filesize

          188KB

        • memory/1516-59-0x0000000000080000-0x0000000000081000-memory.dmp
          Filesize

          4KB

        • memory/1516-61-0x0000000000000000-mapping.dmp
        • memory/1528-62-0x0000000000000000-mapping.dmp
        • memory/1540-67-0x0000000000000000-mapping.dmp
        • memory/1568-82-0x0000000000000000-mapping.dmp
        • memory/1692-83-0x0000000000900000-0x0000000000993000-memory.dmp
          Filesize

          588KB

        • memory/1692-79-0x0000000001F00000-0x0000000002203000-memory.dmp
          Filesize

          3.0MB

        • memory/1692-77-0x0000000000090000-0x00000000000BF000-memory.dmp
          Filesize

          188KB

        • memory/1692-76-0x0000000000AF0000-0x0000000000AFB000-memory.dmp
          Filesize

          44KB

        • memory/1692-75-0x0000000000000000-mapping.dmp
        • memory/1840-68-0x0000000000000000-mapping.dmp
        • memory/1904-64-0x0000000000000000-mapping.dmp