Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 18:53

General

  • Target

    ?????? ?? ???????.exe

  • Size

    662KB

  • MD5

    203f52c19d874bb4206677f8075c7677

  • SHA1

    9f0b37d6aa3854442d0336a0a853593f9177ad85

  • SHA256

    cdcf2838549fff5889e730c6acf553d1de2940575da7e75b8aeefb043dc13ac0

  • SHA512

    d44325b203d93fd86bb75eb75e8ebcd7618d4f3997d6179d8103101a054eb5f9f40a5de53dcacb2f12d8c4adfaa7a115fbece2d4431b772cf3d22a9984343c25

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kvsz

Decoy

okashyns.com

sbsgamedaejeon-two.com

drb77.com

top5dating.com

websprings.online

voizers.com

zenith.site

lahistoriade.com

qv85.com

armandonieto.com

priestvedic.com

jessandjeff.net

magic-desktop.com

jitaji.com

ldmeili.com

yuwanqingmy.com

buzhouorg.com

chaiseloungereviews.com

m2g8way.com

freespin-support.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Users\Admin\AppData\Local\Temp\______ __ _______.exe
      "C:\Users\Admin\AppData\Local\Temp\______ __ _______.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:328
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PvhWkENbJBxfZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFBBE.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:616
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:1508
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1224
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\SysWOW64\rundll32.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1796
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
            PID:1000
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            3⤵
              PID:1960

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Defense Evasion

        Modify Registry

        2
        T1112

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        System Information Discovery

        1
        T1082

        Collection

        Data from Local System

        1
        T1005

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpFBBE.tmp
          Filesize

          1KB

          MD5

          19b3e957c33d8bb64f29f99fcb20c590

          SHA1

          56f87d16795e190f41614c8ecd5242d81cdc0e55

          SHA256

          c72abe14f5f3b8a9d2490d43464182a725b3c1d31e309a6c1985d2b663ee0b6c

          SHA512

          135dcf0b28fba407f10d88d7f3915d7f52bea29fc8a060a5642ea921b91d6ca02fd1ef25774bae7ff892ddc0f1856ae148efa66bed9e99f328bf257e5b3064c5

        • memory/328-54-0x0000000000820000-0x00000000008CC000-memory.dmp
          Filesize

          688KB

        • memory/328-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
          Filesize

          8KB

        • memory/328-56-0x0000000000440000-0x0000000000450000-memory.dmp
          Filesize

          64KB

        • memory/328-57-0x0000000005480000-0x00000000054F2000-memory.dmp
          Filesize

          456KB

        • memory/328-58-0x0000000002020000-0x0000000002064000-memory.dmp
          Filesize

          272KB

        • memory/616-59-0x0000000000000000-mapping.dmp
        • memory/1000-73-0x0000000000000000-mapping.dmp
        • memory/1224-65-0x000000000041ECA0-mapping.dmp
        • memory/1224-62-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/1224-67-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/1224-68-0x00000000009A0000-0x0000000000CA3000-memory.dmp
          Filesize

          3.0MB

        • memory/1224-69-0x0000000000160000-0x0000000000174000-memory.dmp
          Filesize

          80KB

        • memory/1224-64-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/1224-61-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/1272-78-0x0000000007990000-0x0000000007AAF000-memory.dmp
          Filesize

          1.1MB

        • memory/1272-70-0x00000000042E0000-0x00000000043AD000-memory.dmp
          Filesize

          820KB

        • memory/1796-71-0x0000000000000000-mapping.dmp
        • memory/1796-75-0x0000000000090000-0x00000000000BE000-memory.dmp
          Filesize

          184KB

        • memory/1796-76-0x0000000002000000-0x0000000002303000-memory.dmp
          Filesize

          3.0MB

        • memory/1796-77-0x0000000001E40000-0x0000000001ED3000-memory.dmp
          Filesize

          588KB

        • memory/1796-74-0x0000000000540000-0x000000000054E000-memory.dmp
          Filesize

          56KB