Analysis

  • max time kernel
    147s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 11:44

General

  • Target

    SWIFT polizza di versamento.exe

  • Size

    1014KB

  • MD5

    324b9c9d6e2ba577e659b7d84852b4cd

  • SHA1

    9327b4ecb17c2369d312e5d06dc02830611bc7a4

  • SHA256

    a35a1149597435d58703ab662e49dab5ccc96d77529ebacefcdcf9e298c27e51

  • SHA512

    1e6729ef067ac27317c95a2de8f94e8e58d03ea6e13465d793de2602a0d74090076a1867544d35ceb6fa880b0047e2338617532e52841d3be0ebd7cc8d142c8e

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n7ak

Decoy

audereventur.com

huro14.com

wwwjinsha155.com

antiquevendor.com

samuraisoulfood.net

traffic4updates.download

hypersarv.com

rapport-happy-wedding.com

rokutechnosupport.online

allworljob.com

hanaleedossmann.com

kauai-marathon.com

bepbosch.com

kangen-international.com

zoneshopemenowz.com

belviderewrestling.com

ipllink.com

sellingforcreators.com

wwwswty6655.com

qtumboa.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 4 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Users\Admin\AppData\Local\Temp\SWIFT polizza di versamento.exe
      "C:\Users\Admin\AppData\Local\Temp\SWIFT polizza di versamento.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1460
      • C:\Program Files (x86)\internet explorer\ieinstal.exe
        "C:\Program Files (x86)\internet explorer\ieinstal.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1980
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Adds policy Run key to start application
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1904

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    2
    T1060

    Defense Evasion

    Modify Registry

    3
    T1112

    Command and Control

    Web Service

    1
    T1102

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologim.jpeg
      Filesize

      72KB

      MD5

      3ef842e6ca945c5228ac6ea6460cf110

      SHA1

      1749b58f3cd33aac1edc278b7f56fc6a44d0693c

      SHA256

      cc32da11330aa9f54a48cf5e22253318c4e44d266f1eef70be23d162ed9e1785

      SHA512

      ea781e87a82e20d98c165335b6326eec1e1ce918969cfc38f5882a324d68a1a649cadd51ea605f7a36ea6cc60be7160e7dc9a866f63d28fa861b4e0f4609a81f

    • C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologrf.ini
      Filesize

      40B

      MD5

      2f245469795b865bdd1b956c23d7893d

      SHA1

      6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

      SHA256

      1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

      SHA512

      909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

    • C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologri.ini
      Filesize

      40B

      MD5

      d63a82e5d81e02e399090af26db0b9cb

      SHA1

      91d0014c8f54743bba141fd60c9d963f869d76c9

      SHA256

      eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

      SHA512

      38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

    • C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologrv.ini
      Filesize

      40B

      MD5

      ba3b6bc807d4f76794c4b81b09bb9ba5

      SHA1

      24cb89501f0212ff3095ecc0aba97dd563718fb1

      SHA256

      6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507

      SHA512

      ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf

    • memory/1300-63-0x0000000006EE0000-0x000000000707E000-memory.dmp
      Filesize

      1.6MB

    • memory/1300-70-0x0000000007080000-0x000000000717F000-memory.dmp
      Filesize

      1020KB

    • memory/1460-54-0x00000000763E1000-0x00000000763E3000-memory.dmp
      Filesize

      8KB

    • memory/1944-69-0x0000000001D50000-0x0000000001DE3000-memory.dmp
      Filesize

      588KB

    • memory/1944-64-0x0000000000000000-mapping.dmp
    • memory/1944-65-0x00000000007B0000-0x00000000007BD000-memory.dmp
      Filesize

      52KB

    • memory/1944-66-0x0000000000080000-0x00000000000AD000-memory.dmp
      Filesize

      180KB

    • memory/1944-67-0x0000000002020000-0x0000000002323000-memory.dmp
      Filesize

      3.0MB

    • memory/1980-62-0x0000000000130000-0x0000000000144000-memory.dmp
      Filesize

      80KB

    • memory/1980-61-0x0000000000A60000-0x0000000000D63000-memory.dmp
      Filesize

      3.0MB

    • memory/1980-60-0x0000000000400000-0x000000000042D000-memory.dmp
      Filesize

      180KB

    • memory/1980-58-0x000000000041E380-mapping.dmp
    • memory/1980-57-0x0000000000400000-0x000000000042D000-memory.dmp
      Filesize

      180KB

    • memory/1980-55-0x0000000000400000-0x000000000042D000-memory.dmp
      Filesize

      180KB