Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2022 11:16

General

  • Target

    SecuriteInfo.com.W32.Formbook.AA.tr.17194.exe

  • Size

    975KB

  • MD5

    5c5f6418364d135500080bcbaecf1be1

  • SHA1

    718544eece57175e5d34e8f2c02264ffd08cc98a

  • SHA256

    44db6b3b48500386767c3b65e1ccc784a41108486ff999a8d3be6e97b828ab87

  • SHA512

    3484ab14148aa6b370dc1f789e6e5b0fcb54ef7bda2f0d73bb701c7acc03fc61afb106b15d57f8332a4359331abf080e0cdf42ee0dfb52e0f72b36203c3bd90f

  • SSDEEP

    12288:Mi8HjEB1mpzdFnoIvtUg2jIEsnciI50wv2ykDooyZGbR48yArhf7fvqd2222222P:MvD+mpzdCIvtUjmnzfXooX48yAlv

Malware Config

Extracted

Family

formbook

Campaign

od65

Decoy

vWv++sZuMcvF33G4l6XP9EZPtA==

t5BN04mkc6x7eQtgS2Cny1c74wh2JQ==

ZTwBHxvcOi/zDyg=

HwPQCRbYNSbYx9YwkxE7M8jD

zrZ7kYRUKtRvsNwuQoroFy2XBerx1ZfW

x5kgkNmETMWdsMcOWt8=

U0nl/edTCD8CML781w==

eC3RNeH20QR4+QB6

p41iGJpixNsjiSetfNP4Xw==

EgiwGUUP9OJdsjqZh4WLohiTERg=

vKx/M5lOHMDiAarHuukJ

im4Rsi5OGk2Qv9cjI2fC+gReNuXeksU=

dynF4YrQWXXHLMxHG1yVAZNvIO/x1ZfW

5pYrnPK8nt07O4mUm9c=

+tdo4GF+OlqJwtwXcP9Da1H1sBA=

zaoxtveyMFwVVFy/GaHFTfl3EbqsGInQ

Dth/Hns1tuE1cJwjk1SkP0w74wh2JQ==

9LJY/i/hzC/zDyg=

/eZh3RKaXKLXGG1kvkZs5m4=

o31J4w2cWOhJP4mUm9c=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 64 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Formbook.AA.tr.17194.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Formbook.AA.tr.17194.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3228
      • C:\Windows\SysWOW64\iexpress.exe
        iexpress
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1980
    • C:\Windows\SysWOW64\colorcpl.exe
      "C:\Windows\SysWOW64\colorcpl.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3600
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:3156

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1980-216-0x0000000000000000-mapping.dmp
    • memory/1980-223-0x0000000050410000-0x000000005043F000-memory.dmp
      Filesize

      188KB

    • memory/1980-288-0x0000000050411000-0x000000005043F000-memory.dmp
      Filesize

      184KB

    • memory/1980-289-0x00000000034D0000-0x000000000381A000-memory.dmp
      Filesize

      3.3MB

    • memory/1980-290-0x0000000000F80000-0x0000000000F90000-memory.dmp
      Filesize

      64KB

    • memory/1980-293-0x0000000050410000-0x000000005043F000-memory.dmp
      Filesize

      188KB

    • memory/2740-300-0x0000000008670000-0x00000000087A3000-memory.dmp
      Filesize

      1.2MB

    • memory/2740-298-0x0000000008670000-0x00000000087A3000-memory.dmp
      Filesize

      1.2MB

    • memory/2740-291-0x0000000003660000-0x0000000003765000-memory.dmp
      Filesize

      1.0MB

    • memory/3228-167-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-172-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-139-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-141-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-140-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-143-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-142-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-145-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-149-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-148-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-147-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-150-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-146-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-144-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-152-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-151-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-154-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-153-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-156-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-157-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-155-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-158-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-159-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-160-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-161-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-162-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-164-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-165-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-166-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-138-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-163-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-168-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-169-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-170-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-171-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-137-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-173-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-174-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-175-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-176-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-177-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-178-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-179-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-180-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-181-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-182-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-183-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-184-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-185-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-186-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-187-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-188-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-189-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-191-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-192-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-136-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-190-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-193-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-194-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-195-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-196-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-133-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-134-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3228-135-0x00000000024A0000-0x0000000002501000-memory.dmp
      Filesize

      388KB

    • memory/3600-294-0x0000000000310000-0x0000000000329000-memory.dmp
      Filesize

      100KB

    • memory/3600-296-0x0000000002E20000-0x000000000316A000-memory.dmp
      Filesize

      3.3MB

    • memory/3600-297-0x0000000002C50000-0x0000000002CDF000-memory.dmp
      Filesize

      572KB

    • memory/3600-295-0x0000000000E30000-0x0000000000E5D000-memory.dmp
      Filesize

      180KB

    • memory/3600-299-0x0000000000E30000-0x0000000000E5D000-memory.dmp
      Filesize

      180KB

    • memory/3600-292-0x0000000000000000-mapping.dmp