Overview

overview

10

Static

static

sample cat...22.exe

windows10-2004-x64

10

Resubmissions

15-09-2022 17:54

220915-wg9vdadga6 10

15-09-2022 17:52

220915-wfs58shdgr 10

Analysis

  • max time kernel
    84s
  • max time network
    85s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-09-2022 17:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sample catalog2022.exe

  • Size

    288KB

  • MD5

    f0e10bf42bfb76de46b122a9ab381e1f

  • SHA1

    510a22752b3624bb71ab9c198c876b13cd6be9e1

  • SHA256

    5e6ca13143ba73ac8595785c5741f5da0505c0155140d63852aa6d1e74fc081f

  • SHA512

    f6e5ce2530615213a69cc1494667aed3e6b01321aba02c75c4cbb126ef130e8deb1ddd3c23fe73d2de2009dd75dd6c288ee935df1b4471249d5c04e68ae52790

  • SSDEEP

    6144:JH/k7Gstb+5NcvahAKNRqF3hfvAoKqS8bZufRuV8vfBG:Jfkvw5mahbPqnQWv8vfc

Score
10/10
formbookdwdpratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

dwdp

Decoy

jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=

ke1Wv1l26dZZxDikX9dU3s6k8+w=

+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==

GHXPhYzwXcKgZwqBb/kejm7rfobj

yalW64iE8+aXs70=

MD83dBR0KSF4fizgRhAM

Xti3uNm2JDWgssPgRhAM

X7gYbv5uJhpvjdI0Qg==

ydxGznbNJ3tCCLAX4arq4nweMuQ=

Ca+fvtST8OBbosPgRhAM

kG1QegD8mU/E/hLw1t0=

g9FFFjEC5C2IvR/BhbSrpw==

PCkpeg38W0aPdg1rav1DFnVASw==

vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7

G7WYirSZS9EYob8=

WbEWaOVIAPlSNNc4LsfL53weMuQ=

hnyAvEY4n3rTKS4g5mHKxR0=

JN7b0uCqVrQydMl7JNw=

XTki/RASDK6BCW0q8sU=

DQMBWA9wJyOKqqGSmGHKxR0=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Users\Admin\AppData\Local\Temp\sample catalog2022.exe
      "C:\Users\Admin\AppData\Local\Temp\sample catalog2022.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:716
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3036
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1832
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4472

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/716-132-0x00000000008B0000-0x00000000008FE000-memory.dmp
        Filesize

        312KB

        Download
      • memory/716-136-0x00007FFDF4740000-0x00007FFDF5201000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/716-148-0x00007FFDF4740000-0x00007FFDF5201000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/744-159-0x00000000114F0000-0x0000000011500000-memory.dmp
        Filesize

        64KB

        Download
      • memory/744-158-0x00000000114F0000-0x0000000011500000-memory.dmp
        Filesize

        64KB

        Download
      • memory/744-157-0x00000000114F0000-0x0000000011500000-memory.dmp
        Filesize

        64KB

        Download
      • memory/744-156-0x00000000114F0000-0x0000000011500000-memory.dmp
        Filesize

        64KB

        Download
      • memory/744-155-0x00000000114F0000-0x0000000011500000-memory.dmp
        Filesize

        64KB

        Download
      • memory/744-154-0x00000000114B0000-0x00000000114C0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/744-142-0x0000000002B20000-0x0000000002C29000-memory.dmp
        Filesize

        1.0MB

        Download
      • memory/744-153-0x0000000011120000-0x0000000011130000-memory.dmp
        Filesize

        64KB

        Download
      • memory/744-152-0x0000000007C80000-0x0000000007D6A000-memory.dmp
        Filesize

        936KB

        Download
      • memory/744-151-0x0000000007C80000-0x0000000007D6A000-memory.dmp
        Filesize

        936KB

        Download
      • memory/3036-139-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

        Download
      • memory/3036-141-0x0000000001000000-0x0000000001010000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3036-133-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

        Download
      • memory/3036-134-0x00000000004012B0-mapping.dmp
        Download
      • memory/3036-137-0x0000000000401000-0x000000000042F000-memory.dmp
        Filesize

        184KB

        Download
      • memory/3036-138-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

        Download
      • memory/3036-144-0x0000000000401000-0x000000000042F000-memory.dmp
        Filesize

        184KB

        Download
      • memory/3036-140-0x0000000001680000-0x00000000019CA000-memory.dmp
        Filesize

        3.3MB

        Download
      • memory/5004-150-0x00000000010F0000-0x000000000111D000-memory.dmp
        Filesize

        180KB

        Download
      • memory/5004-143-0x0000000000000000-mapping.dmp
        Download
      • memory/5004-145-0x0000000000980000-0x00000000009D7000-memory.dmp
        Filesize

        348KB

        Download
      • memory/5004-147-0x0000000003190000-0x00000000034DA000-memory.dmp
        Filesize

        3.3MB

        Download
      • memory/5004-149-0x0000000002FC0000-0x000000000304F000-memory.dmp
        Filesize

        572KB

        Download
      • memory/5004-146-0x00000000010F0000-0x000000000111D000-memory.dmp
        Filesize

        180KB

        Download