Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 01:16

General

  • Target

    Swift Copy Pdf.exe

  • Size

    324KB

  • MD5

    9a426dc20fda9d009e9420df7b25d4be

  • SHA1

    ee1b322966cc4c1c51a2d2cdf42146b9df551a0d

  • SHA256

    a50d19ddd0b87fdc2529cfb1676f14297125443103286553fbcdf4ffa989f8e7

  • SHA512

    21d19354008766a248a29ddeedfdf46320dd78fb478d480f941d47ea48028ca8843c816013d95ecec84c7fbe14bc1917fde1658b74cc54abaee93edfd065fd24

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

h0d

Decoy

goredfriday.com

ez-sleep.com

xydrgzx.com

paintersjacksonville.com

878212315.com

hotchatcams.com

cavalierwebsolutions.com

spirituellleben.com

emeraldjaya.com

dxyuq.info

rupturefarms.info

cajunnavygear.com

fsqdi.info

thegettinplacewhy.com

z0oav.com

conceptionfitness.com

kraftinvest.info

youngpeoplefutureofnews.com

cvmascotas.net

mundoconnection.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 2 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Looks for VMWare Tools registry key 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Users\Admin\AppData\Local\Temp\Swift Copy Pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Swift Copy Pdf.exe"
      2⤵
      • Checks BIOS information in registry
      • Maps connected drives based on registry
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Users\Admin\AppData\Local\Temp\Swift Copy Pdf.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3704
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4852
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy Pdf.exe"
        3⤵
          PID:3288
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:1068

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\DB1

        Filesize

        40KB

        MD5

        b608d407fc15adea97c26936bc6f03f6

        SHA1

        953e7420801c76393902c0d6bb56148947e41571

        SHA256

        b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

        SHA512

        cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

      • C:\Users\Admin\AppData\Roaming\K354TO33\K35logim.jpeg

        Filesize

        81KB

        MD5

        4a1b6c6b4b2a1d374143815d28669fe7

        SHA1

        f3fb3aebdd70eab3b9047b19d88e5f1f14599558

        SHA256

        6323f97307e69b6a303362b90c233ac3ece144d2cb6aa96f71d0cc6098f7155c

        SHA512

        e4a0fddd3add2720911d8fab699b97a7974cddc70b3d1dc4e71e8a14aae02b092d2fbf3fa72a399061d68feb5be27f429484d433ccd910c73cb338e6e0cbb115

      • C:\Users\Admin\AppData\Roaming\K354TO33\K35logrg.ini

        Filesize

        38B

        MD5

        4aadf49fed30e4c9b3fe4a3dd6445ebe

        SHA1

        1e332822167c6f351b99615eada2c30a538ff037

        SHA256

        75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

        SHA512

        eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

      • C:\Users\Admin\AppData\Roaming\K354TO33\K35logri.ini

        Filesize

        40B

        MD5

        d63a82e5d81e02e399090af26db0b9cb

        SHA1

        91d0014c8f54743bba141fd60c9d963f869d76c9

        SHA256

        eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

        SHA512

        38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

      • C:\Users\Admin\AppData\Roaming\K354TO33\K35logrv.ini

        Filesize

        872B

        MD5

        bbc41c78bae6c71e63cb544a6a284d94

        SHA1

        33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

        SHA256

        ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

        SHA512

        0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

      • memory/1068-144-0x0000000000000000-mapping.dmp

      • memory/2652-136-0x0000000008B50000-0x0000000008CD2000-memory.dmp

        Filesize

        1.5MB

      • memory/2652-143-0x00000000087B0000-0x0000000008876000-memory.dmp

        Filesize

        792KB

      • memory/3288-141-0x0000000000000000-mapping.dmp

      • memory/3704-135-0x0000000001670000-0x0000000001684000-memory.dmp

        Filesize

        80KB

      • memory/3704-134-0x0000000001700000-0x0000000001A4A000-memory.dmp

        Filesize

        3.3MB

      • memory/3704-132-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/3704-131-0x0000000000000000-mapping.dmp

      • memory/4772-130-0x0000000074F90000-0x0000000075541000-memory.dmp

        Filesize

        5.7MB

      • memory/4852-140-0x0000000003210000-0x000000000355A000-memory.dmp

        Filesize

        3.3MB

      • memory/4852-142-0x0000000002F50000-0x0000000002FE3000-memory.dmp

        Filesize

        588KB

      • memory/4852-139-0x0000000000FD0000-0x0000000000FFA000-memory.dmp

        Filesize

        168KB

      • memory/4852-138-0x0000000000350000-0x0000000000783000-memory.dmp

        Filesize

        4.2MB

      • memory/4852-137-0x0000000000000000-mapping.dmp