Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    29-06-2022 08:08

General

  • Target

    tmp.exe

  • Size

    854KB

  • MD5

    cc3b22bd3d92f8209de3a45f1b49b05d

  • SHA1

    46f5d875d74b9dc5f4519b6aff1efdf62df70c73

  • SHA256

    e10cbd14bad3693345f6fa7d09e1336c1b2033900e1b1b55ccf0a76a98b1c79a

  • SHA512

    81eef9b07333b31a8016986f15a6ad519e77643bab1f2c557a5bea4014e1626702854c5c180c883c517ecaebd8a1a823da63d2533e7f9f73c0b8a1d7fd4612cf

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ba17

Decoy

bearwant.com

sdsguanfang.com

steamcommunityvia.top

sugarplumtreasures.com

koronislakefishing.com

jmae.xyz

xhxnqemkiqe.xyz

playzcrew.com

zatwsbq.com

lankofix.com

sh-zhepeng.com

mibodamisxv.online

butterflyjewelry.store

finestrecitalto-spottoday.info

globomateria.com

royalmdarts.com

d4af10836709.com

shepwill.com

67aldrich.info

trustedmakers.club

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:756
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OHyOwWfiz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCCD2.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2016
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1972
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:1780

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpCCD2.tmp
      Filesize

      1KB

      MD5

      34ebff0edf4d0cf20053259092082f18

      SHA1

      51edf31e8f5361f1060855b7585e3afcdba750f5

      SHA256

      1f378cbed7dfeb6053168337cf781e9a6c8b5bdeda3e9431e98321361b06fc65

      SHA512

      f59da27ec0059e951b7a70ad5db22287d8d09fcb0bafb3bb089e8a123deeb4b6a4fbeaec60f60dcdb13e539b9ce1b213ab4c90811c189caec081867bef78de26

    • memory/756-55-0x00000000755B1000-0x00000000755B3000-memory.dmp
      Filesize

      8KB

    • memory/756-56-0x0000000000330000-0x000000000033A000-memory.dmp
      Filesize

      40KB

    • memory/756-57-0x00000000059D0000-0x0000000005A96000-memory.dmp
      Filesize

      792KB

    • memory/756-58-0x0000000005840000-0x00000000058B4000-memory.dmp
      Filesize

      464KB

    • memory/756-54-0x0000000000910000-0x00000000009EC000-memory.dmp
      Filesize

      880KB

    • memory/1116-75-0x00000000000D0000-0x00000000000FF000-memory.dmp
      Filesize

      188KB

    • memory/1116-76-0x00000000022A0000-0x00000000025A3000-memory.dmp
      Filesize

      3.0MB

    • memory/1116-79-0x00000000000D0000-0x00000000000FF000-memory.dmp
      Filesize

      188KB

    • memory/1116-77-0x0000000000B60000-0x0000000000BF4000-memory.dmp
      Filesize

      592KB

    • memory/1116-74-0x0000000000E80000-0x0000000000E94000-memory.dmp
      Filesize

      80KB

    • memory/1116-71-0x0000000000000000-mapping.dmp
    • memory/1260-70-0x0000000004AD0000-0x0000000004C14000-memory.dmp
      Filesize

      1.3MB

    • memory/1260-78-0x0000000007DB0000-0x0000000007EEC000-memory.dmp
      Filesize

      1.2MB

    • memory/1260-80-0x0000000007DB0000-0x0000000007EEC000-memory.dmp
      Filesize

      1.2MB

    • memory/1780-73-0x0000000000000000-mapping.dmp
    • memory/1972-68-0x00000000008D0000-0x0000000000BD3000-memory.dmp
      Filesize

      3.0MB

    • memory/1972-69-0x0000000000150000-0x0000000000165000-memory.dmp
      Filesize

      84KB

    • memory/1972-67-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1972-65-0x000000000041F1E0-mapping.dmp
    • memory/1972-62-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1972-64-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1972-61-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/2016-59-0x0000000000000000-mapping.dmp