Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    04-05-2022 06:55

General

  • Target

    DHL_AWB_NO#907853880911.exe

  • Size

    214KB

  • MD5

    3f54e149af6d9802c9a03de4157c7621

  • SHA1

    8ba2e29b8ef74315f335d7ca666ec56accd80d8d

  • SHA256

    cfa42383596eaed1eff9a35af295930c2e26615a12249041b5d291416d89c8a6

  • SHA512

    4f1401b2cac5d3dbda82ffc7c96151401578b3bb592b7b48caee5e362cb458a77b4e701816a3f88dc6db76c731dff53305d1430c6ab594940ac5706c211c0713

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fw02

Decoy

payer-breakers.com

thesiscoper.com

rental-villa.com

scovikinnovations.com

hydh33.com

allmyshit.rest

lovejaclyn.com

vanessaruizwriting.com

dufonddelaclasse.com

kiddee168.com

monumentalmarketsllc.com

musclegainfatloss.com

avida.info

cosmo-wellness.net

dandelionfusedigital.com

oversizeloadbanners.com

konstelle.store

sdjnsbd.com

czoqg.xyz

5p6xljjse1lq.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Users\Admin\AppData\Local\Temp\DHL_AWB_NO#907853880911.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL_AWB_NO#907853880911.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4668
      • C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exe
        C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exe C:\Users\Admin\AppData\Local\Temp\cfrdmrwg
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3500
        • C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exe
          C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exe C:\Users\Admin\AppData\Local\Temp\cfrdmrwg
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:820
    • C:\Windows\SysWOW64\NETSTAT.EXE
      "C:\Windows\SysWOW64\NETSTAT.EXE"
      2⤵
      • Suspicious use of SetThreadContext
      • Gathers network information
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3108
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exe"
        3⤵
          PID:3240

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Command-Line Interface

    1
    T1059

    Discovery

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\3op6m4d1vcvre
      Filesize

      184KB

      MD5

      883e3a371bba46652cef1db30d23e35b

      SHA1

      334a05dc940245cd8d846ae978e3699136cc3175

      SHA256

      94f2ee1b267281c5e118469d49a996c8d2a67df7d3e219cf0196cd8512f1834f

      SHA512

      d3518f5f2ab949c8e89cc1f4e325f1c94648afc30e97b12f048c6d906fa92c1aa575d9e5568cf88d110a02320e4ff3e884f88171e5493469c29aece412327a69

    • C:\Users\Admin\AppData\Local\Temp\cfrdmrwg
      Filesize

      5KB

      MD5

      0208d602cb7743704120e763f9cdfa2b

      SHA1

      080b53e3eb750f4bc8b1cfe1bea62444b05954a4

      SHA256

      3aabc70c2694750180a2a4f7e56e389163db8d04d4dba660f8783de8905cf8ce

      SHA512

      3203adc437ccda7fd71c919e9c5ae6e3b75076441430e1325c3c9cc47ea03f9744ee5cc700185469a0db461aa844501d6e2da0940740f35e370e5883eee036e6

    • C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exe
      Filesize

      4KB

      MD5

      f3263d29b9c10c4e323227bd098740e8

      SHA1

      7ad4193558a06fa0d44315d6db40e620c440f1d3

      SHA256

      629efdf63bd862d249b94fb80c1d5b4ceb43ee0f2be59ed0310c3cd92c162b0a

      SHA512

      8fed273a8dc13f2e2eab1e90c099b769350e5a6226e307f1042923e78360687a4256a35128826d36c147cf7f5f7c2e5ef750109baf768c96a9ebfea01efb0e56

    • C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exe
      Filesize

      4KB

      MD5

      f3263d29b9c10c4e323227bd098740e8

      SHA1

      7ad4193558a06fa0d44315d6db40e620c440f1d3

      SHA256

      629efdf63bd862d249b94fb80c1d5b4ceb43ee0f2be59ed0310c3cd92c162b0a

      SHA512

      8fed273a8dc13f2e2eab1e90c099b769350e5a6226e307f1042923e78360687a4256a35128826d36c147cf7f5f7c2e5ef750109baf768c96a9ebfea01efb0e56

    • C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exe
      Filesize

      4KB

      MD5

      f3263d29b9c10c4e323227bd098740e8

      SHA1

      7ad4193558a06fa0d44315d6db40e620c440f1d3

      SHA256

      629efdf63bd862d249b94fb80c1d5b4ceb43ee0f2be59ed0310c3cd92c162b0a

      SHA512

      8fed273a8dc13f2e2eab1e90c099b769350e5a6226e307f1042923e78360687a4256a35128826d36c147cf7f5f7c2e5ef750109baf768c96a9ebfea01efb0e56

    • memory/820-139-0x0000000000B80000-0x0000000000ECA000-memory.dmp
      Filesize

      3.3MB

    • memory/820-136-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/820-135-0x0000000000000000-mapping.dmp
    • memory/820-140-0x00000000006D0000-0x00000000006E4000-memory.dmp
      Filesize

      80KB

    • memory/3036-141-0x0000000008C90000-0x0000000008DCE000-memory.dmp
      Filesize

      1.2MB

    • memory/3036-148-0x0000000008F20000-0x000000000901A000-memory.dmp
      Filesize

      1000KB

    • memory/3108-142-0x0000000000000000-mapping.dmp
    • memory/3108-144-0x0000000000FE0000-0x0000000000FEB000-memory.dmp
      Filesize

      44KB

    • memory/3108-145-0x0000000000E90000-0x0000000000EBF000-memory.dmp
      Filesize

      188KB

    • memory/3108-146-0x0000000001780000-0x0000000001ACA000-memory.dmp
      Filesize

      3.3MB

    • memory/3108-147-0x00000000014C0000-0x0000000001553000-memory.dmp
      Filesize

      588KB

    • memory/3240-143-0x0000000000000000-mapping.dmp
    • memory/3500-130-0x0000000000000000-mapping.dmp