Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 18:56

General

  • Target

    PO KH-TECH.exe

  • Size

    400KB

  • MD5

    cec3c5e9ed6457abf83f3650bab34a0d

  • SHA1

    ca81643244ea28e9824d21fc1c779f53679a76dd

  • SHA256

    66812d316b85e20248c4af1f141a372ec1e434d951f7c6fc51402ab23da87845

  • SHA512

    dd02eb4c30720d40383e78e76c912e2689c4dead68a89b113086574d871a21bc73129f21d8ca0b5a00aecd658d69456262af727ccbdbab931a1cf47e1870ac5a

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

q5e

Decoy

2177.ltd

thanxiety.com

max-width.com

fixti.net

mostmaj.com

mobilteknolojiuzmani.com

historyannals.com

wheelchairmotion.com

mossandmoonstonestudio.com

kastellifournis.com

axokey.net

peekl.com

metsteeshirt.com

abcfinancial-inc.com

btxrsp.com

amydh.com

ccoauthority.com

lumacorretora.com

kimfelixrealtor.com

iconext.biz

Signatures

  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 4 IoCs
  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Users\Admin\AppData\Local\Temp\PO KH-TECH.exe
      "C:\Users\Admin\AppData\Local\Temp\PO KH-TECH.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Users\Admin\AppData\Local\Temp\PO KH-TECH.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1992
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:1980
      • C:\Windows\SysWOW64\autofmt.exe
        "C:\Windows\SysWOW64\autofmt.exe"
        2⤵
          PID:976
        • C:\Windows\SysWOW64\autofmt.exe
          "C:\Windows\SysWOW64\autofmt.exe"
          2⤵
            PID:1232
          • C:\Windows\SysWOW64\wscript.exe
            "C:\Windows\SysWOW64\wscript.exe"
            2⤵
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • Drops file in Program Files directory
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:484
            • C:\Windows\SysWOW64\cmd.exe
              /c del "C:\Users\Admin\AppData\Local\Temp\PO KH-TECH.exe"
              3⤵
              • Deletes itself
              PID:1052
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:1716

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Credentials in Files

          1
          T1081

          Collection

          Data from Local System

          1
          T1005

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\17MAR21T\17Mlogim.jpeg
            Filesize

            51KB

            MD5

            4899d8631064d3bdc959dd2a34e8315c

            SHA1

            fbd5a10ac188a31b1900ad6f7b97459868ebb63c

            SHA256

            b97e74d868eef047363660b1ce719552ea2911b27af8d5d8d2a1f7e72c623a3b

            SHA512

            a734a7919e259beb59586ffa89d3795474e8dafe3ac58729076c6f471b5780b8f1f81687e7d6f35585067891956e6281ba7e5b7618ab6ce8ef41ba8c0406a939

          • C:\Users\Admin\AppData\Roaming\17MAR21T\17Mlogrf.ini
            Filesize

            40B

            MD5

            2f245469795b865bdd1b956c23d7893d

            SHA1

            6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

            SHA256

            1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

            SHA512

            909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

          • C:\Users\Admin\AppData\Roaming\17MAR21T\17Mlogri.ini
            Filesize

            40B

            MD5

            d63a82e5d81e02e399090af26db0b9cb

            SHA1

            91d0014c8f54743bba141fd60c9d963f869d76c9

            SHA256

            eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

            SHA512

            38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

          • C:\Users\Admin\AppData\Roaming\17MAR21T\17Mlogrv.ini
            Filesize

            40B

            MD5

            ba3b6bc807d4f76794c4b81b09bb9ba5

            SHA1

            24cb89501f0212ff3095ecc0aba97dd563718fb1

            SHA256

            6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507

            SHA512

            ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf

          • memory/484-72-0x00000000021B0000-0x00000000024B3000-memory.dmp
            Filesize

            3MB

          • memory/484-73-0x0000000000520000-0x00000000005B3000-memory.dmp
            Filesize

            588KB

          • memory/484-70-0x0000000000A60000-0x0000000000A86000-memory.dmp
            Filesize

            152KB

          • memory/484-71-0x0000000000070000-0x000000000009D000-memory.dmp
            Filesize

            180KB

          • memory/484-68-0x0000000000000000-mapping.dmp
          • memory/1052-69-0x0000000000000000-mapping.dmp
          • memory/1068-57-0x0000000002310000-0x000000000234A000-memory.dmp
            Filesize

            232KB

          • memory/1068-56-0x00000000005F0000-0x00000000005F8000-memory.dmp
            Filesize

            32KB

          • memory/1068-55-0x0000000075C51000-0x0000000075C53000-memory.dmp
            Filesize

            8KB

          • memory/1068-54-0x0000000000E70000-0x0000000000EDA000-memory.dmp
            Filesize

            424KB

          • memory/1264-67-0x00000000047F0000-0x00000000048BF000-memory.dmp
            Filesize

            828KB

          • memory/1264-74-0x0000000006300000-0x000000000639B000-memory.dmp
            Filesize

            620KB

          • memory/1992-66-0x0000000000280000-0x0000000000294000-memory.dmp
            Filesize

            80KB

          • memory/1992-65-0x0000000000A00000-0x0000000000D03000-memory.dmp
            Filesize

            3MB

          • memory/1992-64-0x0000000000400000-0x000000000042D000-memory.dmp
            Filesize

            180KB

          • memory/1992-62-0x000000000041E2A0-mapping.dmp
          • memory/1992-61-0x0000000000400000-0x000000000042D000-memory.dmp
            Filesize

            180KB

          • memory/1992-59-0x0000000000400000-0x000000000042D000-memory.dmp
            Filesize

            180KB

          • memory/1992-58-0x0000000000400000-0x000000000042D000-memory.dmp
            Filesize

            180KB