Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    10-11-2021 03:12

General

  • Target

    CI&BL shipping documents.xlsx

  • Size

    311KB

  • MD5

    bc374aadfcfd5dfafaa96a8461f109bf

  • SHA1

    bdfb5c095a97035e29ac95a1f7cbf5f561224af8

  • SHA256

    678d94aaf0de5200cbb7ec2d1829c4264019325a8d4f7000fc330d56844615a4

  • SHA512

    7c396ac68292b98cac3195b410b7774a45fafc40e08a6f05351b2aa2b8da379d0c70829a46186d62d7388eb64c5861765db91d450daab3e2825863c93c5d9366

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\CI&BL shipping documents.xlsx"
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1496
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1620
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Public\vbc.exe"
        3⤵
          PID:1504
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          PID:896
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          PID:900
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:988

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Exploitation for Client Execution

    1
    T1203

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\vbc.exe
      MD5

      053058b864413ebbc46282c26fd4d943

      SHA1

      934b538374713f786919148648fd4c89865355c2

      SHA256

      35c20bb84d57401d88e62390d04f20ba1bbaa4865b72c64c55bdbd9c0e46b52d

      SHA512

      0d61dd01924d161c4e995ef3145acbec64ae5db1c680896a1f7de6bc03d41b359584f3e2f955fcf9160cea9ba20eb2b588b170f7f58dee98f50f02e791f267f3

    • C:\Users\Public\vbc.exe
      MD5

      053058b864413ebbc46282c26fd4d943

      SHA1

      934b538374713f786919148648fd4c89865355c2

      SHA256

      35c20bb84d57401d88e62390d04f20ba1bbaa4865b72c64c55bdbd9c0e46b52d

      SHA512

      0d61dd01924d161c4e995ef3145acbec64ae5db1c680896a1f7de6bc03d41b359584f3e2f955fcf9160cea9ba20eb2b588b170f7f58dee98f50f02e791f267f3

    • C:\Users\Public\vbc.exe
      MD5

      053058b864413ebbc46282c26fd4d943

      SHA1

      934b538374713f786919148648fd4c89865355c2

      SHA256

      35c20bb84d57401d88e62390d04f20ba1bbaa4865b72c64c55bdbd9c0e46b52d

      SHA512

      0d61dd01924d161c4e995ef3145acbec64ae5db1c680896a1f7de6bc03d41b359584f3e2f955fcf9160cea9ba20eb2b588b170f7f58dee98f50f02e791f267f3

    • C:\Users\Public\vbc.exe
      MD5

      053058b864413ebbc46282c26fd4d943

      SHA1

      934b538374713f786919148648fd4c89865355c2

      SHA256

      35c20bb84d57401d88e62390d04f20ba1bbaa4865b72c64c55bdbd9c0e46b52d

      SHA512

      0d61dd01924d161c4e995ef3145acbec64ae5db1c680896a1f7de6bc03d41b359584f3e2f955fcf9160cea9ba20eb2b588b170f7f58dee98f50f02e791f267f3

    • C:\Users\Public\vbc.exe
      MD5

      053058b864413ebbc46282c26fd4d943

      SHA1

      934b538374713f786919148648fd4c89865355c2

      SHA256

      35c20bb84d57401d88e62390d04f20ba1bbaa4865b72c64c55bdbd9c0e46b52d

      SHA512

      0d61dd01924d161c4e995ef3145acbec64ae5db1c680896a1f7de6bc03d41b359584f3e2f955fcf9160cea9ba20eb2b588b170f7f58dee98f50f02e791f267f3

    • \Users\Public\vbc.exe
      MD5

      053058b864413ebbc46282c26fd4d943

      SHA1

      934b538374713f786919148648fd4c89865355c2

      SHA256

      35c20bb84d57401d88e62390d04f20ba1bbaa4865b72c64c55bdbd9c0e46b52d

      SHA512

      0d61dd01924d161c4e995ef3145acbec64ae5db1c680896a1f7de6bc03d41b359584f3e2f955fcf9160cea9ba20eb2b588b170f7f58dee98f50f02e791f267f3

    • \Users\Public\vbc.exe
      MD5

      053058b864413ebbc46282c26fd4d943

      SHA1

      934b538374713f786919148648fd4c89865355c2

      SHA256

      35c20bb84d57401d88e62390d04f20ba1bbaa4865b72c64c55bdbd9c0e46b52d

      SHA512

      0d61dd01924d161c4e995ef3145acbec64ae5db1c680896a1f7de6bc03d41b359584f3e2f955fcf9160cea9ba20eb2b588b170f7f58dee98f50f02e791f267f3

    • \Users\Public\vbc.exe
      MD5

      053058b864413ebbc46282c26fd4d943

      SHA1

      934b538374713f786919148648fd4c89865355c2

      SHA256

      35c20bb84d57401d88e62390d04f20ba1bbaa4865b72c64c55bdbd9c0e46b52d

      SHA512

      0d61dd01924d161c4e995ef3145acbec64ae5db1c680896a1f7de6bc03d41b359584f3e2f955fcf9160cea9ba20eb2b588b170f7f58dee98f50f02e791f267f3

    • \Users\Public\vbc.exe
      MD5

      053058b864413ebbc46282c26fd4d943

      SHA1

      934b538374713f786919148648fd4c89865355c2

      SHA256

      35c20bb84d57401d88e62390d04f20ba1bbaa4865b72c64c55bdbd9c0e46b52d

      SHA512

      0d61dd01924d161c4e995ef3145acbec64ae5db1c680896a1f7de6bc03d41b359584f3e2f955fcf9160cea9ba20eb2b588b170f7f58dee98f50f02e791f267f3

    • memory/572-58-0x0000000074E51000-0x0000000074E53000-memory.dmp
      Filesize

      8KB

    • memory/988-74-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/988-81-0x00000000002D0000-0x00000000002E4000-memory.dmp
      Filesize

      80KB

    • memory/988-77-0x000000000041EB80-mapping.dmp
    • memory/988-75-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/988-76-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/988-80-0x0000000000C60000-0x0000000000F63000-memory.dmp
      Filesize

      3.0MB

    • memory/1220-82-0x0000000006290000-0x00000000063CC000-memory.dmp
      Filesize

      1.2MB

    • memory/1220-90-0x00000000063D0000-0x000000000655C000-memory.dmp
      Filesize

      1.5MB

    • memory/1496-55-0x000000002FD41000-0x000000002FD44000-memory.dmp
      Filesize

      12KB

    • memory/1496-56-0x0000000071121000-0x0000000071123000-memory.dmp
      Filesize

      8KB

    • memory/1496-89-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1496-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1504-84-0x0000000000000000-mapping.dmp
    • memory/1620-83-0x0000000000000000-mapping.dmp
    • memory/1620-86-0x0000000000070000-0x000000000009E000-memory.dmp
      Filesize

      184KB

    • memory/1620-85-0x0000000000B10000-0x0000000000B36000-memory.dmp
      Filesize

      152KB

    • memory/1620-87-0x0000000001F40000-0x0000000002243000-memory.dmp
      Filesize

      3.0MB

    • memory/1620-88-0x00000000008C0000-0x0000000000953000-memory.dmp
      Filesize

      588KB

    • memory/1924-71-0x0000000002060000-0x00000000020AB000-memory.dmp
      Filesize

      300KB

    • memory/1924-70-0x0000000000510000-0x0000000000517000-memory.dmp
      Filesize

      28KB

    • memory/1924-69-0x00000000020B0000-0x00000000020B1000-memory.dmp
      Filesize

      4KB

    • memory/1924-66-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
      Filesize

      4KB

    • memory/1924-63-0x0000000000000000-mapping.dmp