Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
27/09/2022, 09:54
General
- Target PO-10152022.exe
- Size 1.0MB
- Sample220927-lw7nfsecbl
- SHA256 e963c5f4f3d85c3b4ca97d11584940a9a499e7fb89348a8cb4f54ee49ec375a4
Malware Config
Extracted
-
formbook
-
gski
-
w4dqmeRbroucK1d6Rjoieflr
-
4aOmGT8hdudzUsv7ZSwieflr
-
3sTC4jMnhzX+pOJNTZ4=
-
JcH9cI2V8BEeA0eA
-
doY0NLSYANTXiHt9/fbsP706cA==
-
KhN1zCT4Nb5T//UnNQ==
-
y4/RV2RRqNEr0c4nzNWP
-
x8sfUpcmiXqxdfls0dSN
-
rlygM3RQmQ7DliRSBQUKpWJ/FuU=
-
s672RU9HtT3XWaTvdEidsoLRjZb5J5oE
-
uaT/Znv3O9WfXs8GBluj2Z2szeMP
-
QvElhI8JUPHBlRsjsodB5GmUzO0W
-
2uM5rt7BEpcswwJhDA8JnA8=
-
TDFfhORfvuRP//UnNQ==
-
MtPNDl4mh1dSxgZs0dSN
-
ejpoOLXE/Wa7zMwppl3JOt8faA==
-
8qPraI3lOFSrRmCSR4EnHQc=
-
+LOpAwtx0LfGnOJNTZ4=
-
wMQehpwddDxHII+rVCwieflr
-
8KPhZrjGG//aix1s0dSN
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO-10152022.exe"C:\Users\Admin\AppData\Local\Temp\PO-10152022.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO-10152022.exe"{path}"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1768-151-0x0000000002540000-0x00000000025CF000-memory.dmp
memory/1768-147-0x0000000000AB0000-0x0000000000AC4000-memory.dmp
memory/1768-148-0x00000000006C0000-0x00000000006ED000-memory.dmp
memory/1768-149-0x00000000025D0000-0x000000000291A000-memory.dmp
memory/1768-150-0x00000000006C0000-0x00000000006ED000-memory.dmp
memory/2268-135-0x0000000005AA0000-0x0000000005B3C000-memory.dmp
memory/2268-132-0x0000000000EC0000-0x0000000000FC8000-memory.dmp
memory/2268-136-0x0000000005A10000-0x0000000005A1A000-memory.dmp
memory/2268-134-0x0000000005950000-0x00000000059E2000-memory.dmp
memory/2268-133-0x0000000005FB0000-0x0000000006554000-memory.dmp
memory/3036-152-0x0000000002FA0000-0x0000000003051000-memory.dmp
memory/3036-153-0x0000000002FA0000-0x0000000003051000-memory.dmp
memory/3036-145-0x0000000008730000-0x00000000088BC000-memory.dmp
memory/3144-144-0x0000000000C20000-0x0000000000C30000-memory.dmp
memory/3144-143-0x0000000001140000-0x000000000148A000-memory.dmp
memory/3144-142-0x0000000000401000-0x000000000042F000-memory.dmp
memory/3144-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3144-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3144-138-0x0000000000400000-0x000000000042F000-memory.dmp