Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-09-2022 10:43

General

  • Target

    tmp.exe

  • Size

    342KB

  • MD5

    7569ad8644074e28a6a9dba38e67b95a

  • SHA1

    10e73d912b5a6955161213a5f9004988ca4030ac

  • SHA256

    15eb688bffed96b0b324724e48b258dc6c6deb76d71310b26b01e1e12f26108c

  • SHA512

    15fe965c6e8abeff8f9b064122be640a78ca459a45c06f0f99150f979909208ca66693fc96808dca007670a3ace96f32b375b6a591efdb10dc9d9e8b824cb3ae

  • SSDEEP

    6144:+wN/Qnu418i2BYc5lUeE+zjevK5FV0L3Tzz6oVCVdKrLWeuJavoJ8L:+O/Au4j0Yc5lUJXveUCi/f/

Malware Config

Extracted

Family

formbook

Campaign

f4ca

Decoy

QYZ6iE9Y+CsiZpCBareS0uU=

N2FQLAaH6xXE

Vc6t0MQXN+Llxsqg

ElBedmSvYGGm6yLDhHqzAtmlCxWl

4VpIWShqHR5cpjfQ4bs=

mepO9miu/iFiQQ==

Z8Owqh54IlwEpDfQ4bs=

qcq4uT5HecWZG3EVwKTiUE7slrGQGiyo

IaYYoJikKDDqgV/NigZCLA==

4Xz5pfoCCW/76NnOUrFEOw==

xiijSkVJ3Yuh9OKDcmui/d2lCxWl

cr8MmfpCEu0ULsO3p6w=

JLm2yKHo7hdVb8O3p6w=

Hriy5svWm2Qfq9mPQib9jJI65gOr

2G3nkRpidunlxsqg

gPHUAeXmi8Q9ARy3

6l5WaOf8BxhQDkp5gKQ=

KHHiXs4WOqXZdPhpaw==

+UQ5Vz5O0Ms9ARy3

pNQygKu0OziAvjOHRGLnJA==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\tmp.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%'
        3⤵
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:612
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\SysWOW64\mstsc.exe
          "C:\Windows\SysWOW64\mstsc.exe"
          4⤵
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:320
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            5⤵
              PID:1332

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll
      Filesize

      949KB

      MD5

      38a3e021eb32c9976adaf0b3372080fc

      SHA1

      68e02803c646be21007d90bec841c176b82211fd

      SHA256

      8cde0275d60da0d11954f73c7c8862cfc4b306f61bb8b1ce14abe4a193af2652

      SHA512

      b886cc112f2750e7300b66f7242850659fa49fdc97f75aed376cb9f5440875f303a143bf8b51068ec42674f1ebe1dfcc40534f3a7aed3cc4d20f9274b9a66d18

    • memory/320-81-0x0000000000D70000-0x0000000000E74000-memory.dmp
      Filesize

      1.0MB

    • memory/320-86-0x0000000000120000-0x000000000014D000-memory.dmp
      Filesize

      180KB

    • memory/320-84-0x00000000009C0000-0x0000000000A4F000-memory.dmp
      Filesize

      572KB

    • memory/320-83-0x0000000002280000-0x0000000002583000-memory.dmp
      Filesize

      3.0MB

    • memory/320-82-0x0000000000120000-0x000000000014D000-memory.dmp
      Filesize

      180KB

    • memory/320-77-0x0000000000000000-mapping.dmp
    • memory/612-57-0x0000000000000000-mapping.dmp
    • memory/612-69-0x0000000070030000-0x00000000705DB000-memory.dmp
      Filesize

      5.7MB

    • memory/612-73-0x0000000070030000-0x00000000705DB000-memory.dmp
      Filesize

      5.7MB

    • memory/1224-87-0x0000000006CB0000-0x0000000006DE5000-memory.dmp
      Filesize

      1.2MB

    • memory/1224-85-0x0000000006CB0000-0x0000000006DE5000-memory.dmp
      Filesize

      1.2MB

    • memory/1224-72-0x0000000006270000-0x00000000063A5000-memory.dmp
      Filesize

      1.2MB

    • memory/1224-76-0x0000000006B70000-0x0000000006CA2000-memory.dmp
      Filesize

      1.2MB

    • memory/1516-71-0x0000000000160000-0x0000000000170000-memory.dmp
      Filesize

      64KB

    • memory/1516-79-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1516-70-0x00000000008B0000-0x0000000000BB3000-memory.dmp
      Filesize

      3.0MB

    • memory/1516-75-0x0000000000220000-0x0000000000230000-memory.dmp
      Filesize

      64KB

    • memory/1516-68-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/1516-67-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1516-80-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/1516-60-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1516-66-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1516-64-0x00000000004012B0-mapping.dmp
    • memory/1516-63-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1516-61-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1972-54-0x0000000000E60000-0x0000000000EBA000-memory.dmp
      Filesize

      360KB

    • memory/1972-58-0x0000000000560000-0x000000000057C000-memory.dmp
      Filesize

      112KB

    • memory/1972-56-0x0000000075501000-0x0000000075503000-memory.dmp
      Filesize

      8KB

    • memory/1972-55-0x00000000004F0000-0x000000000053A000-memory.dmp
      Filesize

      296KB