Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    05-05-2022 05:36

General

  • Target

    d02d076842cc94fa6612b13ff0d2f77e1ff9150d22607cfe3962da4234cf4ed5.exe

  • Size

    214KB

  • MD5

    5fc986129c3d833b1c7e5ba6ff3678bc

  • SHA1

    2ace6bc0488df9b8592e25be3de38e6c9a0c16da

  • SHA256

    d02d076842cc94fa6612b13ff0d2f77e1ff9150d22607cfe3962da4234cf4ed5

  • SHA512

    7f496926ea5026eda78532c001ce21e6f9f6ec4474ee995909a53f106def291cd7338072e56b29b7844ea43dc83fcd3eb6f8e36d2db5d8d5e0281059d60f9043

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fw02

Decoy

payer-breakers.com

thesiscoper.com

rental-villa.com

scovikinnovations.com

hydh33.com

allmyshit.rest

lovejaclyn.com

vanessaruizwriting.com

dufonddelaclasse.com

kiddee168.com

monumentalmarketsllc.com

musclegainfatloss.com

avida.info

cosmo-wellness.net

dandelionfusedigital.com

oversizeloadbanners.com

konstelle.store

sdjnsbd.com

czoqg.xyz

5p6xljjse1lq.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\d02d076842cc94fa6612b13ff0d2f77e1ff9150d22607cfe3962da4234cf4ed5.exe
      "C:\Users\Admin\AppData\Local\Temp\d02d076842cc94fa6612b13ff0d2f77e1ff9150d22607cfe3962da4234cf4ed5.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Users\Admin\AppData\Local\Temp\rysgtozci.exe
        C:\Users\Admin\AppData\Local\Temp\rysgtozci.exe C:\Users\Admin\AppData\Local\Temp\wduqqtzg
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1328
        • C:\Users\Admin\AppData\Local\Temp\rysgtozci.exe
          C:\Users\Admin\AppData\Local\Temp\rysgtozci.exe C:\Users\Admin\AppData\Local\Temp\wduqqtzg
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2216
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Gathers network information
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3920
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\rysgtozci.exe"
        3⤵
          PID:3596

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Command-Line Interface

    1
    T1059

    Discovery

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ptcgl43g463vgbr58
      Filesize

      184KB

      MD5

      b5b1c1f4818202956b29108fb25dec20

      SHA1

      7e74a79237d3090b0dbac83b2c038d849fde6382

      SHA256

      d0da793571aa99c98e2afca3be0f3d6850aabbacf2aca4eeab8013e4ebf77a67

      SHA512

      8ecd3fe32528d30c76c47763db6723cd69d2d8842fefcc7b3f12599b4f4f546c5ad4bd5c3c604f666fde36fd168945303414d54cd709df56fe96d08bbfe063e2

    • C:\Users\Admin\AppData\Local\Temp\rysgtozci.exe
      Filesize

      5KB

      MD5

      96b3c3b0f05b4cedf349797d7cb05627

      SHA1

      b2d7084dcae06676c21d0ab393c60d6480e1d03f

      SHA256

      874f73e2673462859967afc64c3c33c1957d7b69915124cca91ced26dcfcd5c0

      SHA512

      e264e979679a7dcd410b2916ec16f8333cba6a45d59faad99c9a45ff75d0e574d6ecbb52fb21a7b89732a8236b5f5416fd8fcffb595692f451dd6556b9641e73

    • C:\Users\Admin\AppData\Local\Temp\rysgtozci.exe
      Filesize

      5KB

      MD5

      96b3c3b0f05b4cedf349797d7cb05627

      SHA1

      b2d7084dcae06676c21d0ab393c60d6480e1d03f

      SHA256

      874f73e2673462859967afc64c3c33c1957d7b69915124cca91ced26dcfcd5c0

      SHA512

      e264e979679a7dcd410b2916ec16f8333cba6a45d59faad99c9a45ff75d0e574d6ecbb52fb21a7b89732a8236b5f5416fd8fcffb595692f451dd6556b9641e73

    • C:\Users\Admin\AppData\Local\Temp\rysgtozci.exe
      Filesize

      5KB

      MD5

      96b3c3b0f05b4cedf349797d7cb05627

      SHA1

      b2d7084dcae06676c21d0ab393c60d6480e1d03f

      SHA256

      874f73e2673462859967afc64c3c33c1957d7b69915124cca91ced26dcfcd5c0

      SHA512

      e264e979679a7dcd410b2916ec16f8333cba6a45d59faad99c9a45ff75d0e574d6ecbb52fb21a7b89732a8236b5f5416fd8fcffb595692f451dd6556b9641e73

    • C:\Users\Admin\AppData\Local\Temp\wduqqtzg
      Filesize

      5KB

      MD5

      cea27fda9443dd5882439188c2494a7b

      SHA1

      89b7f9c46c4462f37ee6e91d639ccdd3084e03cd

      SHA256

      26a0ef0fe1fdab9e6dae3caecec085c3800a44d32cd5b87c182c0c0a6b559f59

      SHA512

      12040c4009e23ec2d4cf15a9f5b31587070f6086f2816efeb946a6d2f1609339ba66a8639f187d2ac97d0284264df7aee0f62b40ea550567b5e35f66992a1c87

    • memory/1328-116-0x0000000000000000-mapping.dmp
    • memory/2060-134-0x00000000026B0000-0x0000000002776000-memory.dmp
      Filesize

      792KB

    • memory/2060-127-0x0000000004DD0000-0x0000000004F7C000-memory.dmp
      Filesize

      1.7MB

    • memory/2216-124-0x0000000000A40000-0x0000000000D60000-memory.dmp
      Filesize

      3.1MB

    • memory/2216-126-0x00000000005F0000-0x0000000000604000-memory.dmp
      Filesize

      80KB

    • memory/2216-122-0x000000000041F150-mapping.dmp
    • memory/2216-121-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/3596-129-0x0000000000000000-mapping.dmp
    • memory/3920-128-0x0000000000000000-mapping.dmp
    • memory/3920-130-0x0000000000CD0000-0x0000000000CDB000-memory.dmp
      Filesize

      44KB

    • memory/3920-131-0x0000000002F80000-0x0000000002FAF000-memory.dmp
      Filesize

      188KB

    • memory/3920-132-0x0000000003810000-0x0000000003B30000-memory.dmp
      Filesize

      3.1MB

    • memory/3920-133-0x0000000003670000-0x000000000380C000-memory.dmp
      Filesize

      1.6MB