Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 11:22

General

  • Target

    PO_CS009.exe

  • Size

    362KB

  • MD5

    08b794da39ef13910c12b15e072c1edd

  • SHA1

    b0e926330b4b67e823c2a12e9b8fa789a1b9291f

  • SHA256

    4092b0f7ea14add16e6f6f35071b074458a19d4550af50a80ed5742cc7046568

  • SHA512

    97822a1eb2197352f67037ec6b3c6cf8b0a54ebac288f84d3a254d1b1af2c53e2a5db4e3a13e91df80d4ce127a033485915e01f47fa0ecd6edd0d778655a0156

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

q5e

Decoy

2177.ltd

thanxiety.com

max-width.com

fixti.net

mostmaj.com

mobilteknolojiuzmani.com

historyannals.com

wheelchairmotion.com

mossandmoonstonestudio.com

kastellifournis.com

axokey.net

peekl.com

metsteeshirt.com

abcfinancial-inc.com

btxrsp.com

amydh.com

ccoauthority.com

lumacorretora.com

kimfelixrealtor.com

iconext.biz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Users\Admin\AppData\Local\Temp\PO_CS009.exe
      "C:\Users\Admin\AppData\Local\Temp\PO_CS009.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Users\Admin\AppData\Local\Temp\PO_CS009.exe
        "{path}"
        3⤵
          PID:3544
        • C:\Users\Admin\AppData\Local\Temp\PO_CS009.exe
          "{path}"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:4760
      • C:\Windows\SysWOW64\wlanext.exe
        "C:\Windows\SysWOW64\wlanext.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:820
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\PO_CS009.exe"
          3⤵
            PID:3200
          • C:\Windows\SysWOW64\cmd.exe
            /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
            3⤵
              PID:4444
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:4772

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Credentials in Files

          1
          T1081

          Collection

          Data from Local System

          1
          T1005

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\DB1
            Filesize

            40KB

            MD5

            b608d407fc15adea97c26936bc6f03f6

            SHA1

            953e7420801c76393902c0d6bb56148947e41571

            SHA256

            b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

            SHA512

            cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

          • memory/820-146-0x0000000000AD0000-0x0000000000B63000-memory.dmp
            Filesize

            588KB

          • memory/820-145-0x0000000000FD0000-0x000000000131A000-memory.dmp
            Filesize

            3.3MB

          • memory/820-144-0x0000000000370000-0x000000000039D000-memory.dmp
            Filesize

            180KB

          • memory/820-143-0x0000000000FB0000-0x0000000000FC7000-memory.dmp
            Filesize

            92KB

          • memory/820-141-0x0000000000000000-mapping.dmp
          • memory/1504-140-0x0000000007C90000-0x0000000007E02000-memory.dmp
            Filesize

            1.4MB

          • memory/1504-147-0x0000000002580000-0x000000000261C000-memory.dmp
            Filesize

            624KB

          • memory/3200-142-0x0000000000000000-mapping.dmp
          • memory/3544-134-0x0000000000000000-mapping.dmp
          • memory/4444-148-0x0000000000000000-mapping.dmp
          • memory/4664-130-0x0000000000C50000-0x0000000000CB0000-memory.dmp
            Filesize

            384KB

          • memory/4664-133-0x0000000006430000-0x00000000069D4000-memory.dmp
            Filesize

            5.6MB

          • memory/4664-132-0x0000000005800000-0x000000000589C000-memory.dmp
            Filesize

            624KB

          • memory/4664-131-0x0000000005760000-0x00000000057F2000-memory.dmp
            Filesize

            584KB

          • memory/4760-139-0x0000000000AB0000-0x0000000000AC4000-memory.dmp
            Filesize

            80KB

          • memory/4760-138-0x0000000000F60000-0x00000000012AA000-memory.dmp
            Filesize

            3.3MB

          • memory/4760-136-0x0000000000400000-0x000000000042D000-memory.dmp
            Filesize

            180KB

          • memory/4760-135-0x0000000000000000-mapping.dmp