Analysis

  • max time kernel
    154s
  • max time network
    191s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    07-07-2022 13:19

General

  • Target

    049 BL DRAFT.exe

  • Size

    167KB

  • MD5

    dd9252c3656c0f6cb68a35f59c047758

  • SHA1

    c9ccd18031e4f99cef7fed58a93ed5c7c616274c

  • SHA256

    f5e3f4ae71d7846b03325a53361ea4a31b12871a2e4808cae4afcd3dce35e2ea

  • SHA512

    a9e564512a2fa28fafcd4ac8838b80948e95146e03fc3e26358f1a117eb309e7456bb5f7eb00193a585b156db86d843c85b4afc1db46676f819733b639fea260

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ba17

Decoy

bearwant.com

sdsguanfang.com

steamcommunityvia.top

sugarplumtreasures.com

koronislakefishing.com

jmae.xyz

xhxnqemkiqe.xyz

playzcrew.com

zatwsbq.com

lankofix.com

sh-zhepeng.com

mibodamisxv.online

butterflyjewelry.store

finestrecitalto-spottoday.info

globomateria.com

royalmdarts.com

d4af10836709.com

shepwill.com

67aldrich.info

trustedmakers.club

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook payload 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Users\Admin\AppData\Local\Temp\049 BL DRAFT.exe
      "C:\Users\Admin\AppData\Local\Temp\049 BL DRAFT.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:964
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1088
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1536
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:932

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/932-77-0x0000000000000000-mapping.dmp
    • memory/964-54-0x00000000003C0000-0x00000000003F0000-memory.dmp
      Filesize

      192KB

    • memory/964-55-0x00000000753B1000-0x00000000753B3000-memory.dmp
      Filesize

      8KB

    • memory/964-56-0x0000000005100000-0x000000000518A000-memory.dmp
      Filesize

      552KB

    • memory/964-57-0x0000000004250000-0x000000000429E000-memory.dmp
      Filesize

      312KB

    • memory/964-58-0x0000000005090000-0x00000000050DC000-memory.dmp
      Filesize

      304KB

    • memory/1088-61-0x0000000070070000-0x000000007061B000-memory.dmp
      Filesize

      5.7MB

    • memory/1088-62-0x0000000070070000-0x000000007061B000-memory.dmp
      Filesize

      5.7MB

    • memory/1088-63-0x0000000070070000-0x000000007061B000-memory.dmp
      Filesize

      5.7MB

    • memory/1088-59-0x0000000000000000-mapping.dmp
    • memory/1384-84-0x00000000046D0000-0x00000000047BC000-memory.dmp
      Filesize

      944KB

    • memory/1384-82-0x00000000046D0000-0x00000000047BC000-memory.dmp
      Filesize

      944KB

    • memory/1384-74-0x0000000004C40000-0x0000000004DC9000-memory.dmp
      Filesize

      1.5MB

    • memory/1536-73-0x00000000001D0000-0x00000000001E5000-memory.dmp
      Filesize

      84KB

    • memory/1536-72-0x0000000002350000-0x0000000002653000-memory.dmp
      Filesize

      3.0MB

    • memory/1536-71-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1536-68-0x000000000041F1E0-mapping.dmp
    • memory/1536-67-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1536-65-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1536-64-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1752-75-0x0000000000000000-mapping.dmp
    • memory/1752-78-0x0000000000AA0000-0x0000000000ABC000-memory.dmp
      Filesize

      112KB

    • memory/1752-79-0x0000000000080000-0x00000000000AF000-memory.dmp
      Filesize

      188KB

    • memory/1752-80-0x0000000001EC0000-0x00000000021C3000-memory.dmp
      Filesize

      3.0MB

    • memory/1752-81-0x00000000007E0000-0x0000000000874000-memory.dmp
      Filesize

      592KB

    • memory/1752-83-0x0000000000080000-0x00000000000AF000-memory.dmp
      Filesize

      188KB