Resubmissions

29-09-2022 07:16

220929-h3s7vsaae7 10

19-09-2022 14:00

220919-rbbm6sbhf6 10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-09-2022 07:16

General

  • Target

    Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe

  • Size

    277KB

  • MD5

    adfbf0d0858c2ccf0c3070967f1c5a3e

  • SHA1

    e723c9f072504c3345f91829000ec7d96ac6661a

  • SHA256

    54d71b452ceceb7769f2ab610d157005849ec32aae5544acaa99d08f8d12cd95

  • SHA512

    7c08f20307f27a8f91fdf53efd1280b898e78fbc8382c4b3dd3fc3f7f75204e0c4fafb5e7bc97d53872d46fc3ab72851703c8f0d6e932c407d3b5e6e68f07749

  • SSDEEP

    6144:KAJjLwdO06a3KpeQnaMDCbd9D+E2fCos4OianeAsIJ/8kAG:KjO06IKpRnacCxx+EcCBnbX8kL

Malware Config

Extracted

Family

formbook

Campaign

f4ca

Decoy

QYZ6iE9Y+CsiZpCBareS0uU=

N2FQLAaH6xXE

Vc6t0MQXN+Llxsqg

ElBedmSvYGGm6yLDhHqzAtmlCxWl

4VpIWShqHR5cpjfQ4bs=

mepO9miu/iFiQQ==

Z8Owqh54IlwEpDfQ4bs=

qcq4uT5HecWZG3EVwKTiUE7slrGQGiyo

IaYYoJikKDDqgV/NigZCLA==

4Xz5pfoCCW/76NnOUrFEOw==

xiijSkVJ3Yuh9OKDcmui/d2lCxWl

cr8MmfpCEu0ULsO3p6w=

JLm2yKHo7hdVb8O3p6w=

Hriy5svWm2Qfq9mPQib9jJI65gOr

2G3nkRpidunlxsqg

gPHUAeXmi8Q9ARy3

6l5WaOf8BxhQDkp5gKQ=

KHHiXs4WOqXZdPhpaw==

+UQ5Vz5O0Ms9ARy3

pNQygKu0OziAvjOHRGLnJA==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Users\Admin\AppData\Local\Temp\Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe
      "C:\Users\Admin\AppData\Local\Temp\Invoice_Tracking_657895995845HKFDHKLFDLKHDFKLFDKHLFDKL89634.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:952
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:472

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll
      Filesize

      890KB

      MD5

      8402a6aa76d7787ff03943dd129e3d83

      SHA1

      895338cb761d62930ca93918011fd2cd33d5b30c

      SHA256

      49ff99d5b24f4f7d5a8ea175f35a6548c74b04e5c621c60121b5088dab19b4eb

      SHA512

      39bbe90385be35492825929296aae771fb4afb00a1f6a48f0e4ec17bc1097c3a32cea3b22033116c82695e66acbd6c847483a8da21e7302240467b58e39169ea

    • memory/952-61-0x00000000004012B0-mapping.dmp
    • memory/952-74-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/952-57-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/952-58-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/952-60-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/952-70-0x0000000000220000-0x0000000000230000-memory.dmp
      Filesize

      64KB

    • memory/952-63-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/952-64-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/952-65-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/952-66-0x0000000000850000-0x0000000000B53000-memory.dmp
      Filesize

      3.0MB

    • memory/952-67-0x00000000000F0000-0x0000000000100000-memory.dmp
      Filesize

      64KB

    • memory/952-73-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1216-68-0x0000000004FB0000-0x000000000512C000-memory.dmp
      Filesize

      1.5MB

    • memory/1216-79-0x0000000004920000-0x00000000049FD000-memory.dmp
      Filesize

      884KB

    • memory/1216-82-0x0000000004920000-0x00000000049FD000-memory.dmp
      Filesize

      884KB

    • memory/1216-71-0x0000000006800000-0x000000000690A000-memory.dmp
      Filesize

      1.0MB

    • memory/1284-80-0x0000000000080000-0x00000000000AD000-memory.dmp
      Filesize

      180KB

    • memory/1284-75-0x0000000000B00000-0x0000000000B0D000-memory.dmp
      Filesize

      52KB

    • memory/1284-76-0x0000000000080000-0x00000000000AD000-memory.dmp
      Filesize

      180KB

    • memory/1284-77-0x0000000001F10000-0x0000000002213000-memory.dmp
      Filesize

      3.0MB

    • memory/1284-78-0x00000000008D0000-0x000000000095F000-memory.dmp
      Filesize

      572KB

    • memory/1284-81-0x0000000076171000-0x0000000076173000-memory.dmp
      Filesize

      8KB

    • memory/1284-72-0x0000000000000000-mapping.dmp
    • memory/1808-56-0x0000000000390000-0x0000000000398000-memory.dmp
      Filesize

      32KB

    • memory/1808-54-0x00000000013D0000-0x000000000141A000-memory.dmp
      Filesize

      296KB

    • memory/1808-55-0x0000000000380000-0x000000000038C000-memory.dmp
      Filesize

      48KB