Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220722-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-08-2022 09:23

General

  • Target

    Re,best offer.exe

  • Size

    973KB

  • MD5

    c7f79795432fc3467aadeb0f6f736d1f

  • SHA1

    3deaba5114fc244750f4af2fd6b218f96bdb5cf3

  • SHA256

    bd29947fc88d96b3f5b2982d67f1d5df99aad570ce86b87ed91103b8f43c3b8f

  • SHA512

    f46283bd9dc71b44c7a094f151319a03f30e9b503dfc5ef02855ccedcd1cacd8e1f110daa73f83c9218be1152a2e42826861ab18253b6d7b8b771ea86c723702

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:408
    • C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe
      "C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe
        "C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"
        3⤵
          PID:1684
        • C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe
          "C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1464
      • C:\Windows\SysWOW64\ipconfig.exe
        "C:\Windows\SysWOW64\ipconfig.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Gathers network information
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3656
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\Re,best offer.exe"
          3⤵
            PID:4472

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Command-Line Interface

      1
      T1059

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/408-154-0x0000000007E80000-0x0000000007F7F000-memory.dmp
        Filesize

        1020KB

      • memory/408-152-0x0000000007E80000-0x0000000007F7F000-memory.dmp
        Filesize

        1020KB

      • memory/408-144-0x0000000008240000-0x0000000008360000-memory.dmp
        Filesize

        1.1MB

      • memory/1400-132-0x00000000009F0000-0x0000000000AE8000-memory.dmp
        Filesize

        992KB

      • memory/1400-133-0x0000000005AC0000-0x0000000006064000-memory.dmp
        Filesize

        5.6MB

      • memory/1400-134-0x0000000005510000-0x00000000055A2000-memory.dmp
        Filesize

        584KB

      • memory/1400-135-0x0000000005480000-0x000000000548A000-memory.dmp
        Filesize

        40KB

      • memory/1400-136-0x0000000008EC0000-0x0000000008F5C000-memory.dmp
        Filesize

        624KB

      • memory/1400-137-0x0000000008F60000-0x0000000008FC6000-memory.dmp
        Filesize

        408KB

      • memory/1464-143-0x0000000001590000-0x00000000015A5000-memory.dmp
        Filesize

        84KB

      • memory/1464-141-0x0000000001100000-0x000000000144A000-memory.dmp
        Filesize

        3.3MB

      • memory/1464-140-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/1464-146-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/1464-139-0x0000000000000000-mapping.dmp
      • memory/1684-138-0x0000000000000000-mapping.dmp
      • memory/3656-145-0x0000000000000000-mapping.dmp
      • memory/3656-149-0x0000000000960000-0x000000000098F000-memory.dmp
        Filesize

        188KB

      • memory/3656-148-0x0000000000E30000-0x0000000000E3B000-memory.dmp
        Filesize

        44KB

      • memory/3656-150-0x0000000001270000-0x00000000015BA000-memory.dmp
        Filesize

        3.3MB

      • memory/3656-151-0x00000000015C0000-0x0000000001654000-memory.dmp
        Filesize

        592KB

      • memory/3656-153-0x0000000000960000-0x000000000098F000-memory.dmp
        Filesize

        188KB

      • memory/4472-147-0x0000000000000000-mapping.dmp