Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    27-06-2022 13:30

General

  • Target

    YANBU QUOTATION LIST 06.2022.exe

  • Size

    689KB

  • MD5

    2e43d196e446bfc5c13be5b260137ada

  • SHA1

    2fcf21897ecc2315fc1c668834ae6a638db409f7

  • SHA256

    6ff2623794625f34d8ebf1d840ececdce903836c5a06b1907f83a0cea46ac57f

  • SHA512

    803679f0dc6c83ef743bbd6686eb4d66301ab3e1288b64aea1a7bcc6fd57bdb3a7ec1b0ceb448976d5bd2e08f2b64e4c0811a401282de75b243e4599728172fe

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ba17

Decoy

bearwant.com

sdsguanfang.com

steamcommunityvia.top

sugarplumtreasures.com

koronislakefishing.com

jmae.xyz

xhxnqemkiqe.xyz

playzcrew.com

zatwsbq.com

lankofix.com

sh-zhepeng.com

mibodamisxv.online

butterflyjewelry.store

finestrecitalto-spottoday.info

globomateria.com

royalmdarts.com

d4af10836709.com

shepwill.com

67aldrich.info

trustedmakers.club

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:888
    • C:\Users\Admin\AppData\Local\Temp\YANBU QUOTATION LIST 06.2022.exe
      "C:\Users\Admin\AppData\Local\Temp\YANBU QUOTATION LIST 06.2022.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vtxcrPRespPyL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7CC1.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:3532
      • C:\Users\Admin\AppData\Local\Temp\YANBU QUOTATION LIST 06.2022.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:5084
    • C:\Windows\SysWOW64\help.exe
      "C:\Windows\SysWOW64\help.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1876
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\YANBU QUOTATION LIST 06.2022.exe"
        3⤵
          PID:404

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp7CC1.tmp
      Filesize

      1KB

      MD5

      28098935835558e177d061a775973efc

      SHA1

      60c8b3bc523d70724fe5f8654178d7340f48e6ed

      SHA256

      c6d296a6a9435bcbb7322bcec344d927e0ed44c651f96441eb4522698ee11450

      SHA512

      1c9087a49f3007bfa470fd24bb5317dbf246d597fa457864cdf656cc18e54820e133b9973899ebbef4a52adabcdc0967cbf72f9092e0aeb0cb330ea822bfc727

    • memory/404-146-0x0000000000000000-mapping.dmp
    • memory/888-143-0x0000000008500000-0x00000000085C5000-memory.dmp
      Filesize

      788KB

    • memory/888-153-0x00000000085D0000-0x000000000872E000-memory.dmp
      Filesize

      1.4MB

    • memory/888-151-0x00000000085D0000-0x000000000872E000-memory.dmp
      Filesize

      1.4MB

    • memory/1876-152-0x0000000000350000-0x000000000037F000-memory.dmp
      Filesize

      188KB

    • memory/1876-150-0x0000000000B70000-0x0000000000C04000-memory.dmp
      Filesize

      592KB

    • memory/1876-148-0x0000000001000000-0x000000000134A000-memory.dmp
      Filesize

      3.3MB

    • memory/1876-149-0x0000000000350000-0x000000000037F000-memory.dmp
      Filesize

      188KB

    • memory/1876-147-0x0000000000FF0000-0x0000000000FF7000-memory.dmp
      Filesize

      28KB

    • memory/1876-144-0x0000000000000000-mapping.dmp
    • memory/3532-136-0x0000000000000000-mapping.dmp
    • memory/4700-135-0x0000000005CD0000-0x0000000005E76000-memory.dmp
      Filesize

      1.6MB

    • memory/4700-130-0x00000000006F0000-0x00000000007A2000-memory.dmp
      Filesize

      712KB

    • memory/4700-134-0x0000000005210000-0x000000000521A000-memory.dmp
      Filesize

      40KB

    • memory/4700-133-0x00000000052B0000-0x000000000534C000-memory.dmp
      Filesize

      624KB

    • memory/4700-132-0x0000000005170000-0x0000000005202000-memory.dmp
      Filesize

      584KB

    • memory/4700-131-0x0000000005720000-0x0000000005CC4000-memory.dmp
      Filesize

      5.6MB

    • memory/5084-142-0x0000000001990000-0x00000000019A5000-memory.dmp
      Filesize

      84KB

    • memory/5084-145-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/5084-141-0x0000000001570000-0x00000000018BA000-memory.dmp
      Filesize

      3.3MB

    • memory/5084-139-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/5084-138-0x0000000000000000-mapping.dmp