Analysis

  • max time kernel
    147s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-07-2022 00:19

General

  • Target

    BL# BKKCM3215800.exe

  • Size

    170KB

  • MD5

    2ec6d3e0a7fe0d612b5ae232a01e7d2b

  • SHA1

    b1971757c64ccaaaff17d4e5d7c6db4eb0843b2a

  • SHA256

    2198c2bb61788ff27d22b8a16ff4ddbfc343d0c3f641ce8c86e42100d338a83b

  • SHA512

    540cb081def6eb76c74cc1cd33a9e28d0c41eac808cac4a86fe1ca5280da6e7b40f9a1e52ff2d6149e9531c9ce9d0929f8af26234af114f484ff081bf62fdaf3

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ba17

Decoy

bearwant.com

sdsguanfang.com

steamcommunityvia.top

sugarplumtreasures.com

koronislakefishing.com

jmae.xyz

xhxnqemkiqe.xyz

playzcrew.com

zatwsbq.com

lankofix.com

sh-zhepeng.com

mibodamisxv.online

butterflyjewelry.store

finestrecitalto-spottoday.info

globomateria.com

royalmdarts.com

d4af10836709.com

shepwill.com

67aldrich.info

trustedmakers.club

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Users\Admin\AppData\Local\Temp\BL# BKKCM3215800.exe
      "C:\Users\Admin\AppData\Local\Temp\BL# BKKCM3215800.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3504
      • C:\Users\Admin\AppData\Local\Temp\BL# BKKCM3215800.exe
        "C:\Users\Admin\AppData\Local\Temp\BL# BKKCM3215800.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:204
    • C:\Windows\SysWOW64\help.exe
      "C:\Windows\SysWOW64\help.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5108
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\BL# BKKCM3215800.exe"
        3⤵
          PID:3740

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/204-143-0x0000000000000000-mapping.dmp
    • memory/204-150-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/204-147-0x0000000000A90000-0x0000000000AA5000-memory.dmp
      Filesize

      84KB

    • memory/204-146-0x0000000000F00000-0x000000000124A000-memory.dmp
      Filesize

      3.3MB

    • memory/204-144-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1060-158-0x0000000007CC0000-0x0000000007DE5000-memory.dmp
      Filesize

      1.1MB

    • memory/1060-156-0x0000000007CC0000-0x0000000007DE5000-memory.dmp
      Filesize

      1.1MB

    • memory/1060-148-0x0000000002C50000-0x0000000002D29000-memory.dmp
      Filesize

      868KB

    • memory/3396-131-0x0000000005820000-0x0000000005DC4000-memory.dmp
      Filesize

      5.6MB

    • memory/3396-132-0x0000000005320000-0x00000000053B2000-memory.dmp
      Filesize

      584KB

    • memory/3396-133-0x00000000054D0000-0x00000000054DA000-memory.dmp
      Filesize

      40KB

    • memory/3396-130-0x0000000000960000-0x0000000000990000-memory.dmp
      Filesize

      192KB

    • memory/3504-137-0x00000000055E0000-0x0000000005602000-memory.dmp
      Filesize

      136KB

    • memory/3504-136-0x0000000005650000-0x0000000005C78000-memory.dmp
      Filesize

      6.2MB

    • memory/3504-141-0x0000000007C30000-0x00000000082AA000-memory.dmp
      Filesize

      6.5MB

    • memory/3504-140-0x00000000063B0000-0x00000000063CE000-memory.dmp
      Filesize

      120KB

    • memory/3504-139-0x0000000005D60000-0x0000000005DC6000-memory.dmp
      Filesize

      408KB

    • memory/3504-138-0x0000000005CF0000-0x0000000005D56000-memory.dmp
      Filesize

      408KB

    • memory/3504-134-0x0000000000000000-mapping.dmp
    • memory/3504-142-0x0000000006880000-0x000000000689A000-memory.dmp
      Filesize

      104KB

    • memory/3504-135-0x0000000002DD0000-0x0000000002E06000-memory.dmp
      Filesize

      216KB

    • memory/3740-151-0x0000000000000000-mapping.dmp
    • memory/5108-152-0x0000000000C90000-0x0000000000C97000-memory.dmp
      Filesize

      28KB

    • memory/5108-153-0x0000000000CA0000-0x0000000000FEA000-memory.dmp
      Filesize

      3.3MB

    • memory/5108-154-0x0000000000410000-0x000000000043F000-memory.dmp
      Filesize

      188KB

    • memory/5108-155-0x0000000000970000-0x0000000000A04000-memory.dmp
      Filesize

      592KB

    • memory/5108-157-0x0000000000410000-0x000000000043F000-memory.dmp
      Filesize

      188KB

    • memory/5108-149-0x0000000000000000-mapping.dmp