Analysis

  • max time kernel
    147s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    11-07-2022 07:17

General

  • Target

    BOOKING DETAILS 235201252305.exe

  • Size

    170KB

  • MD5

    570614c38bcedd9090cba96e6a61ce8e

  • SHA1

    d4c2a51512d314e50d650e37e1ec7fe6af7aace9

  • SHA256

    e23ac135f38743c3b47deed6e514d29fe5f52bd6070754b125d62ad7db246703

  • SHA512

    4cc4bc2e2cde9b066704f3f8d2e86fabbe6a95bbee8cb0182a7669c1bbad62c0e48e29b8297b5546756117180643423b84df82fbe87a5ed81674fe1abd75287e

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ba17

Decoy

bearwant.com

sdsguanfang.com

steamcommunityvia.top

sugarplumtreasures.com

koronislakefishing.com

jmae.xyz

xhxnqemkiqe.xyz

playzcrew.com

zatwsbq.com

lankofix.com

sh-zhepeng.com

mibodamisxv.online

butterflyjewelry.store

finestrecitalto-spottoday.info

globomateria.com

royalmdarts.com

d4af10836709.com

shepwill.com

67aldrich.info

trustedmakers.club

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Users\Admin\AppData\Local\Temp\BOOKING DETAILS 235201252305.exe
      "C:\Users\Admin\AppData\Local\Temp\BOOKING DETAILS 235201252305.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1040
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4208
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        3⤵
          PID:3840
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:5024
      • C:\Windows\SysWOW64\WWAHost.exe
        "C:\Windows\SysWOW64\WWAHost.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4220
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:2728

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1040-131-0x0000000005AB0000-0x0000000006054000-memory.dmp
        Filesize

        5.6MB

      • memory/1040-132-0x0000000005500000-0x0000000005592000-memory.dmp
        Filesize

        584KB

      • memory/1040-133-0x00000000055A0000-0x00000000055AA000-memory.dmp
        Filesize

        40KB

      • memory/1040-130-0x0000000000C70000-0x0000000000CA0000-memory.dmp
        Filesize

        192KB

      • memory/2148-159-0x00000000082A0000-0x0000000008429000-memory.dmp
        Filesize

        1.5MB

      • memory/2148-157-0x00000000082A0000-0x0000000008429000-memory.dmp
        Filesize

        1.5MB

      • memory/2148-149-0x0000000002930000-0x0000000002A18000-memory.dmp
        Filesize

        928KB

      • memory/2728-152-0x0000000000000000-mapping.dmp
      • memory/3840-143-0x0000000000000000-mapping.dmp
      • memory/4208-137-0x0000000005A10000-0x0000000005A32000-memory.dmp
        Filesize

        136KB

      • memory/4208-138-0x00000000061C0000-0x0000000006226000-memory.dmp
        Filesize

        408KB

      • memory/4208-141-0x0000000008130000-0x00000000087AA000-memory.dmp
        Filesize

        6.5MB

      • memory/4208-142-0x0000000006DB0000-0x0000000006DCA000-memory.dmp
        Filesize

        104KB

      • memory/4208-139-0x0000000006230000-0x0000000006296000-memory.dmp
        Filesize

        408KB

      • memory/4208-134-0x0000000000000000-mapping.dmp
      • memory/4208-135-0x00000000032D0000-0x0000000003306000-memory.dmp
        Filesize

        216KB

      • memory/4208-140-0x00000000068B0000-0x00000000068CE000-memory.dmp
        Filesize

        120KB

      • memory/4208-136-0x0000000005A60000-0x0000000006088000-memory.dmp
        Filesize

        6.2MB

      • memory/4220-153-0x0000000000F10000-0x0000000000FEC000-memory.dmp
        Filesize

        880KB

      • memory/4220-150-0x0000000000000000-mapping.dmp
      • memory/4220-154-0x0000000001D40000-0x000000000208A000-memory.dmp
        Filesize

        3.3MB

      • memory/4220-155-0x0000000000DB0000-0x0000000000DDF000-memory.dmp
        Filesize

        188KB

      • memory/4220-156-0x0000000001BB0000-0x0000000001C44000-memory.dmp
        Filesize

        592KB

      • memory/4220-158-0x0000000000DB0000-0x0000000000DDF000-memory.dmp
        Filesize

        188KB

      • memory/5024-151-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/5024-148-0x0000000001270000-0x0000000001285000-memory.dmp
        Filesize

        84KB

      • memory/5024-146-0x0000000002F90000-0x00000000032DA000-memory.dmp
        Filesize

        3.3MB

      • memory/5024-145-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/5024-144-0x0000000000000000-mapping.dmp