Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 01:19

General

  • Target

    RFQ-MNAMR-001RB-WhastsAAp Images.exe

  • Size

    398KB

  • MD5

    239efcf744fc1e906b704d4eebe4a962

  • SHA1

    c8c0fe13941c237cd72c2eb3adcfc13f9513d32d

  • SHA256

    aae9b362789cdf8a185d9b963cb3b0ba5d7f5599285cecd8625944168232c42c

  • SHA512

    affe8bdcfbdc3e2554f2b8c887a9d417a69b5e031f7433ecf8971cc14a55bbabb70fbacd495a23d355662a679fbca321c38eb46e37949ea51e2e290ad7558af9

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

xcm

Decoy

xn--rhq5es99j.com

storage-download-fast.review

campingfamilly.com

rientbottcieux.info

2015z.com

999izo.info

guojiafangshui.com

jpaecwra.com

evergreenmga.net

semprebellissima.store

meizin01.com

bangladesherkhobor.net

rivercoveresidencessg.com

carbonfibercrew.com

1rbld2.biz

nikolatesla.review

erlandsonsbrygga.com

cursosreikiadistancia.com

centraldemotorersltda.com

shelskysbrooklynbagels.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 4 IoCs
  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\AppData\Local\Temp\RFQ-MNAMR-001RB-WhastsAAp Images.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ-MNAMR-001RB-WhastsAAp Images.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:872
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fgySYm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3812.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:1868
      • C:\Users\Admin\AppData\Local\Temp\RFQ-MNAMR-001RB-WhastsAAp Images.exe
        "{path}"
        3⤵
          PID:532
        • C:\Users\Admin\AppData\Local\Temp\RFQ-MNAMR-001RB-WhastsAAp Images.exe
          "{path}"
          3⤵
            PID:1104
          • C:\Users\Admin\AppData\Local\Temp\RFQ-MNAMR-001RB-WhastsAAp Images.exe
            "{path}"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:1944
        • C:\Windows\SysWOW64\msdt.exe
          "C:\Windows\SysWOW64\msdt.exe"
          2⤵
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Drops file in Program Files directory
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:760
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\RFQ-MNAMR-001RB-WhastsAAp Images.exe"
            3⤵
            • Deletes itself
            PID:788

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp3812.tmp

        Filesize

        1KB

        MD5

        50ac39a60c5586335e23eb6d6c02e2ec

        SHA1

        30160aa6b063c200918b3a0e1a2cae3089b2485f

        SHA256

        6a6cf1a71fba0da6d9b665906cf3d32c8404ca0d7f6ddc7a15b167ae7fd9756a

        SHA512

        614eb42be3b9d71a7534f49683107a0458e2193133e2c7dab76cfd2d4a8379a2d1848dc42667af31033307227c37c132ad2a16a0a414f5a97b3b2120c4ae5b53

      • C:\Users\Admin\AppData\Roaming\LL2105RU\LL2logim.jpeg

        Filesize

        56KB

        MD5

        2da88795f0e0fff9b210fc829007b499

        SHA1

        b3359271d2dc9dd35c1270500de23e3ca590d6e9

        SHA256

        736606fabcad6fb4866d133fc452722abb162f57e6f3fb792cacf3295384f474

        SHA512

        937a876137d6e2a771fa0de16b035b005a1a6e0a75040f06211beabbf261e926bd6eb6c99ada238fa15ecbfc2a4e2e6d7bdde075fbd97da6fb1ea237e4b4c1ba

      • C:\Users\Admin\AppData\Roaming\LL2105RU\LL2logri.ini

        Filesize

        40B

        MD5

        d63a82e5d81e02e399090af26db0b9cb

        SHA1

        91d0014c8f54743bba141fd60c9d963f869d76c9

        SHA256

        eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

        SHA512

        38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

      • C:\Users\Admin\AppData\Roaming\LL2105RU\LL2logrv.ini

        Filesize

        40B

        MD5

        ba3b6bc807d4f76794c4b81b09bb9ba5

        SHA1

        24cb89501f0212ff3095ecc0aba97dd563718fb1

        SHA256

        6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507

        SHA512

        ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf

      • memory/760-74-0x0000000002230000-0x0000000002533000-memory.dmp

        Filesize

        3.0MB

      • memory/760-75-0x0000000002000000-0x0000000002093000-memory.dmp

        Filesize

        588KB

      • memory/760-73-0x0000000000080000-0x00000000000AA000-memory.dmp

        Filesize

        168KB

      • memory/760-69-0x0000000000000000-mapping.dmp

      • memory/760-72-0x00000000006A0000-0x0000000000794000-memory.dmp

        Filesize

        976KB

      • memory/788-71-0x0000000000000000-mapping.dmp

      • memory/872-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

        Filesize

        8KB

      • memory/872-58-0x0000000002139000-0x000000000214A000-memory.dmp

        Filesize

        68KB

      • memory/872-55-0x0000000074860000-0x0000000074E0B000-memory.dmp

        Filesize

        5.7MB

      • memory/1220-76-0x0000000004D60000-0x0000000004E64000-memory.dmp

        Filesize

        1.0MB

      • memory/1220-68-0x0000000004C70000-0x0000000004D5E000-memory.dmp

        Filesize

        952KB

      • memory/1868-56-0x0000000000000000-mapping.dmp

      • memory/1944-59-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/1944-66-0x00000000009E0000-0x0000000000CE3000-memory.dmp

        Filesize

        3.0MB

      • memory/1944-67-0x0000000000200000-0x0000000000214000-memory.dmp

        Filesize

        80KB

      • memory/1944-65-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/1944-63-0x000000000041B6F0-mapping.dmp

      • memory/1944-62-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/1944-60-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB