Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 18:46

General

  • Target

    products samples.exe

  • Size

    494KB

  • MD5

    e64f048c8c196195443a74e911748666

  • SHA1

    42d24e14f852afba26c793bf4063ad80f581452a

  • SHA256

    cbb6d89187847aab1fcff6b5d832ea80bca30bfe5520702133cab83335392ead

  • SHA512

    0101a9d60cfbf7dbabf5e7c3d119c12bd5774926387fb51606e5715ee80554c8311b5bc2060e4a329199a696799a593b8a7b4af9315c06a009228e3832e56f75

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n7ak

Decoy

audereventur.com

huro14.com

wwwjinsha155.com

antiquevendor.com

samuraisoulfood.net

traffic4updates.download

hypersarv.com

rapport-happy-wedding.com

rokutechnosupport.online

allworljob.com

hanaleedossmann.com

kauai-marathon.com

bepbosch.com

kangen-international.com

zoneshopemenowz.com

belviderewrestling.com

ipllink.com

sellingforcreators.com

wwwswty6655.com

qtumboa.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

  • Formbook Payload 3 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Users\Admin\AppData\Local\Temp\products samples.exe
      "C:\Users\Admin\AppData\Local\Temp\products samples.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:564
      • C:\Program Files (x86)\internet explorer\ieinstal.exe
        "C:\Program Files (x86)\internet explorer\ieinstal.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4040
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:5000
      • C:\Windows\SysWOW64\autofmt.exe
        "C:\Windows\SysWOW64\autofmt.exe"
        2⤵
          PID:4996
        • C:\Windows\SysWOW64\autoconv.exe
          "C:\Windows\SysWOW64\autoconv.exe"
          2⤵
            PID:4496
          • C:\Windows\SysWOW64\colorcpl.exe
            "C:\Windows\SysWOW64\colorcpl.exe"
            2⤵
            • Adds policy Run key to start application
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1480
            • C:\Windows\SysWOW64\cmd.exe
              /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
              3⤵
                PID:2912
              • C:\Program Files\Mozilla Firefox\Firefox.exe
                "C:\Program Files\Mozilla Firefox\Firefox.exe"
                3⤵
                  PID:3408

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Persistence

            Registry Run Keys / Startup Folder

            2
            T1060

            Defense Evasion

            Modify Registry

            3
            T1112

            Credential Access

            Credentials in Files

            1
            T1081

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Web Service

            1
            T1102

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\DB1
              Filesize

              40KB

              MD5

              b608d407fc15adea97c26936bc6f03f6

              SHA1

              953e7420801c76393902c0d6bb56148947e41571

              SHA256

              b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

              SHA512

              cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

            • C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologim.jpeg
              Filesize

              77KB

              MD5

              3a0c93bc7aeb719b6849ac45b49437cd

              SHA1

              b9ae8057066049687619ae3d37201b6c9ec76300

              SHA256

              fc359a834d821ab0697f1ebea291c28457a4c6dcdeb07ee6d03ad3cd11124ce7

              SHA512

              5f5b202fecdce2dd3607af23ddb34e76846ecc95db52a8d50053be91206a9f3a74c773090adabdf55ccd4fb44f86b1ff03327ae092175600eb6a659ac6749e15

            • C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologrf.ini
              Filesize

              40B

              MD5

              2f245469795b865bdd1b956c23d7893d

              SHA1

              6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

              SHA256

              1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

              SHA512

              909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

            • C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologrg.ini
              Filesize

              38B

              MD5

              4aadf49fed30e4c9b3fe4a3dd6445ebe

              SHA1

              1e332822167c6f351b99615eada2c30a538ff037

              SHA256

              75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

              SHA512

              eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

            • C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologri.ini
              Filesize

              40B

              MD5

              d63a82e5d81e02e399090af26db0b9cb

              SHA1

              91d0014c8f54743bba141fd60c9d963f869d76c9

              SHA256

              eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

              SHA512

              38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

            • C:\Users\Admin\AppData\Roaming\94O2R65S\94Ologrv.ini
              Filesize

              872B

              MD5

              bbc41c78bae6c71e63cb544a6a284d94

              SHA1

              33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

              SHA256

              ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

              SHA512

              0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

            • memory/796-143-0x0000000003160000-0x0000000003253000-memory.dmp
              Filesize

              972KB

            • memory/796-135-0x00000000084D0000-0x0000000008648000-memory.dmp
              Filesize

              1.5MB

            • memory/1480-138-0x0000000003280000-0x00000000035CA000-memory.dmp
              Filesize

              3.3MB

            • memory/1480-139-0x0000000000FB0000-0x0000000000FDD000-memory.dmp
              Filesize

              180KB

            • memory/1480-137-0x0000000000CB0000-0x0000000000CC9000-memory.dmp
              Filesize

              100KB

            • memory/1480-142-0x0000000002FC0000-0x0000000003053000-memory.dmp
              Filesize

              588KB

            • memory/1480-136-0x0000000000000000-mapping.dmp
            • memory/2912-140-0x0000000000000000-mapping.dmp
            • memory/4040-130-0x0000000000000000-mapping.dmp
            • memory/4040-134-0x00000000026C0000-0x00000000026D4000-memory.dmp
              Filesize

              80KB

            • memory/4040-133-0x0000000002790000-0x0000000002ADA000-memory.dmp
              Filesize

              3.3MB

            • memory/4040-131-0x0000000010410000-0x000000001043D000-memory.dmp
              Filesize

              180KB