Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
14/09/2022, 13:18
General
- Target Purchase. Order & Contract (A-4553).exe
- Size 709KB
- Sample220914-qjx1psebbk
- SHA256 18522fd93f9cb13ee2bb32d6c8090c8c1cddfd0c6a91e284a4ad303e1d6ea048
Malware Config
Extracted
-
formbook
-
etfh
-
7GZ6EDICLTxRlA==
-
PLtlQESN4qcH
-
Hl1Kaj5k/IbeqjD2BbfAIAg=
-
IGIFzYb9FfCCzV9l
-
i6XHgFSN4qcH
-
OJwysQEOtacTgw==
-
sA02ZDlg/cQuq8OHbjJrZj5hZfBW2hA=
-
4RW/U8ADLezCD/fcwg==
-
3B8SJMhHZuG8DjTuj7wqNA==
-
YYEwzTC4Qw4gaIUlH4jx
-
Ues8V/VDLTxRlA==
-
xA958bGoMrQ=
-
YKOQqIa0Qwqq9IR2
-
VoV5nnq7XeY/BZmK2BtWmyiCrQ==
-
O/cKZyK2Wdw386OK9NobskQM
-
k50X1qTOYjVFGrU=
-
+T65goQJnSnD0sqxeMT78ktXVOho4BQ=
-
uJapUOj3EKOK0BjGpf4ePA==
-
QNs2VScpggMYnsh0
-
Z7XOfidNLTxRlA==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Purchase. Order & Contract (A-4553).exe"C:\Users\Admin\AppData\Local\Temp\Purchase. Order & Contract (A-4553).exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase. Order & Contract (A-4553).exe"C:\Users\Admin\AppData\Local\Temp\Purchase. Order & Contract (A-4553).exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Purchase. Order & Contract (A-4553).exe"C:\Users\Admin\AppData\Local\Temp\Purchase. Order & Contract (A-4553).exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"4⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2576-146-0x0000000002A70000-0x0000000002B70000-memory.dmp
memory/2576-159-0x0000000007260000-0x00000000073E0000-memory.dmp
memory/2576-157-0x0000000007260000-0x00000000073E0000-memory.dmp
memory/2576-150-0x0000000002D60000-0x0000000002E53000-memory.dmp
memory/3676-158-0x0000000000C00000-0x0000000000C2B000-memory.dmp
memory/3676-156-0x0000000002A40000-0x0000000002ACF000-memory.dmp
memory/3676-155-0x0000000002B20000-0x0000000002E6A000-memory.dmp
memory/3676-154-0x0000000000C00000-0x0000000000C2B000-memory.dmp
memory/3676-153-0x0000000000590000-0x00000000006CA000-memory.dmp
memory/4728-151-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4728-140-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4728-143-0x0000000001820000-0x0000000001B6A000-memory.dmp
memory/4728-148-0x000000000041F000-0x0000000000421000-memory.dmp
memory/4728-149-0x00000000017E0000-0x00000000017F0000-memory.dmp
memory/4728-142-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4728-145-0x00000000012B0000-0x00000000012C0000-memory.dmp
memory/4728-144-0x000000000041F000-0x0000000000421000-memory.dmp
memory/4768-132-0x0000000000C60000-0x0000000000D16000-memory.dmp
memory/4768-137-0x0000000009350000-0x00000000093B6000-memory.dmp
memory/4768-136-0x00000000092B0000-0x000000000934C000-memory.dmp
memory/4768-135-0x00000000056B0000-0x00000000056BA000-memory.dmp
memory/4768-134-0x00000000056C0000-0x0000000005752000-memory.dmp
memory/4768-133-0x0000000005BD0000-0x0000000006174000-memory.dmp