Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    27-06-2022 13:30

General

  • Target

    YANBU QUOTATION LIST 06.2022.exe

  • Size

    689KB

  • MD5

    2e43d196e446bfc5c13be5b260137ada

  • SHA1

    2fcf21897ecc2315fc1c668834ae6a638db409f7

  • SHA256

    6ff2623794625f34d8ebf1d840ececdce903836c5a06b1907f83a0cea46ac57f

  • SHA512

    803679f0dc6c83ef743bbd6686eb4d66301ab3e1288b64aea1a7bcc6fd57bdb3a7ec1b0ceb448976d5bd2e08f2b64e4c0811a401282de75b243e4599728172fe

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ba17

Decoy

bearwant.com

sdsguanfang.com

steamcommunityvia.top

sugarplumtreasures.com

koronislakefishing.com

jmae.xyz

xhxnqemkiqe.xyz

playzcrew.com

zatwsbq.com

lankofix.com

sh-zhepeng.com

mibodamisxv.online

butterflyjewelry.store

finestrecitalto-spottoday.info

globomateria.com

royalmdarts.com

d4af10836709.com

shepwill.com

67aldrich.info

trustedmakers.club

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 5 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\YANBU QUOTATION LIST 06.2022.exe
      "C:\Users\Admin\AppData\Local\Temp\YANBU QUOTATION LIST 06.2022.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1644
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vtxcrPRespPyL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5BB8.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:1212
      • C:\Users\Admin\AppData\Local\Temp\YANBU QUOTATION LIST 06.2022.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1696
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\SysWOW64\control.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\YANBU QUOTATION LIST 06.2022.exe"
        3⤵
        • Deletes itself
        PID:1768

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp5BB8.tmp
    Filesize

    1KB

    MD5

    59eda904b7ff998846feef5668c52ee2

    SHA1

    b9d2d6874d75e5b4668cdb0c2a360ef18d467a63

    SHA256

    0b00207d69333837199f7c2906f992c94afeb7f1787272239a4a86f4b0e20a8a

    SHA512

    73279bc676ac67fe62c230e6abcb00153e5314a786ebbaffb9dfc68bb236617bccd40f715fd50719f303c8b6d616db07d29bee35d98de890df0415ea73734cff

  • memory/1212-59-0x0000000000000000-mapping.dmp
  • memory/1268-80-0x00000000062C0000-0x00000000063E5000-memory.dmp
    Filesize

    1.1MB

  • memory/1268-78-0x00000000062C0000-0x00000000063E5000-memory.dmp
    Filesize

    1.1MB

  • memory/1268-70-0x0000000006080000-0x000000000617B000-memory.dmp
    Filesize

    1004KB

  • memory/1592-75-0x0000000000080000-0x00000000000AF000-memory.dmp
    Filesize

    188KB

  • memory/1592-71-0x0000000000000000-mapping.dmp
  • memory/1592-79-0x0000000000080000-0x00000000000AF000-memory.dmp
    Filesize

    188KB

  • memory/1592-77-0x0000000000670000-0x0000000000704000-memory.dmp
    Filesize

    592KB

  • memory/1592-76-0x0000000002130000-0x0000000002433000-memory.dmp
    Filesize

    3.0MB

  • memory/1592-74-0x0000000000720000-0x000000000073F000-memory.dmp
    Filesize

    124KB

  • memory/1644-54-0x0000000000B90000-0x0000000000C42000-memory.dmp
    Filesize

    712KB

  • memory/1644-57-0x0000000005190000-0x0000000005218000-memory.dmp
    Filesize

    544KB

  • memory/1644-58-0x0000000002050000-0x0000000002084000-memory.dmp
    Filesize

    208KB

  • memory/1644-56-0x0000000000570000-0x000000000057A000-memory.dmp
    Filesize

    40KB

  • memory/1644-55-0x00000000769D1000-0x00000000769D3000-memory.dmp
    Filesize

    8KB

  • memory/1696-68-0x0000000000840000-0x0000000000B43000-memory.dmp
    Filesize

    3.0MB

  • memory/1696-69-0x0000000000210000-0x0000000000225000-memory.dmp
    Filesize

    84KB

  • memory/1696-67-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1696-65-0x000000000041F1E0-mapping.dmp
  • memory/1696-64-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1696-62-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1696-61-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

  • memory/1768-73-0x0000000000000000-mapping.dmp