Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-09-2022 10:43

General

  • Target

    tmp.exe

  • Size

    342KB

  • MD5

    7569ad8644074e28a6a9dba38e67b95a

  • SHA1

    10e73d912b5a6955161213a5f9004988ca4030ac

  • SHA256

    15eb688bffed96b0b324724e48b258dc6c6deb76d71310b26b01e1e12f26108c

  • SHA512

    15fe965c6e8abeff8f9b064122be640a78ca459a45c06f0f99150f979909208ca66693fc96808dca007670a3ace96f32b375b6a591efdb10dc9d9e8b824cb3ae

  • SSDEEP

    6144:+wN/Qnu418i2BYc5lUeE+zjevK5FV0L3Tzz6oVCVdKrLWeuJavoJ8L:+O/Au4j0Yc5lUJXveUCi/f/

Malware Config

Extracted

Family

formbook

Campaign

f4ca

Decoy

QYZ6iE9Y+CsiZpCBareS0uU=

N2FQLAaH6xXE

Vc6t0MQXN+Llxsqg

ElBedmSvYGGm6yLDhHqzAtmlCxWl

4VpIWShqHR5cpjfQ4bs=

mepO9miu/iFiQQ==

Z8Owqh54IlwEpDfQ4bs=

qcq4uT5HecWZG3EVwKTiUE7slrGQGiyo

IaYYoJikKDDqgV/NigZCLA==

4Xz5pfoCCW/76NnOUrFEOw==

xiijSkVJ3Yuh9OKDcmui/d2lCxWl

cr8MmfpCEu0ULsO3p6w=

JLm2yKHo7hdVb8O3p6w=

Hriy5svWm2Qfq9mPQib9jJI65gOr

2G3nkRpidunlxsqg

gPHUAeXmi8Q9ARy3

6l5WaOf8BxhQDkp5gKQ=

KHHiXs4WOqXZdPhpaw==

+UQ5Vz5O0Ms9ARy3

pNQygKu0OziAvjOHRGLnJA==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3576
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\tmp.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%'
        3⤵
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5108
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1584
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:4408
      • C:\Windows\SysWOW64\autofmt.exe
        "C:\Windows\SysWOW64\autofmt.exe"
        2⤵
          PID:3352
        • C:\Windows\SysWOW64\autofmt.exe
          "C:\Windows\SysWOW64\autofmt.exe"
          2⤵
            PID:3008
          • C:\Windows\SysWOW64\autofmt.exe
            "C:\Windows\SysWOW64\autofmt.exe"
            2⤵
              PID:3048
            • C:\Windows\SysWOW64\autofmt.exe
              "C:\Windows\SysWOW64\autofmt.exe"
              2⤵
                PID:2288
              • C:\Windows\SysWOW64\autofmt.exe
                "C:\Windows\SysWOW64\autofmt.exe"
                2⤵
                  PID:2272
                • C:\Windows\SysWOW64\autofmt.exe
                  "C:\Windows\SysWOW64\autofmt.exe"
                  2⤵
                    PID:4392
                  • C:\Windows\SysWOW64\autofmt.exe
                    "C:\Windows\SysWOW64\autofmt.exe"
                    2⤵
                      PID:2692
                    • C:\Windows\SysWOW64\autofmt.exe
                      "C:\Windows\SysWOW64\autofmt.exe"
                      2⤵
                        PID:2736
                      • C:\Windows\SysWOW64\help.exe
                        "C:\Windows\SysWOW64\help.exe"
                        2⤵
                        • Suspicious use of SetThreadContext
                        • Modifies Internet Explorer settings
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1828
                        • C:\Program Files\Mozilla Firefox\Firefox.exe
                          "C:\Program Files\Mozilla Firefox\Firefox.exe"
                          3⤵
                            PID:3596

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Defense Evasion

                      Modify Registry

                      1
                      T1112

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/1584-155-0x0000000000401000-0x000000000042F000-memory.dmp
                        Filesize

                        184KB

                      • memory/1584-156-0x0000000000400000-0x000000000042F000-memory.dmp
                        Filesize

                        188KB

                      • memory/1584-148-0x0000000000FD0000-0x0000000000FE0000-memory.dmp
                        Filesize

                        64KB

                      • memory/1584-147-0x0000000001480000-0x00000000017CA000-memory.dmp
                        Filesize

                        3.3MB

                      • memory/1584-142-0x0000000000401000-0x000000000042F000-memory.dmp
                        Filesize

                        184KB

                      • memory/1584-137-0x0000000000000000-mapping.dmp
                      • memory/1584-138-0x0000000000400000-0x000000000042F000-memory.dmp
                        Filesize

                        188KB

                      • memory/1584-141-0x0000000000400000-0x000000000042F000-memory.dmp
                        Filesize

                        188KB

                      • memory/1828-154-0x0000000000000000-mapping.dmp
                      • memory/1828-162-0x0000000000940000-0x000000000096D000-memory.dmp
                        Filesize

                        180KB

                      • memory/1828-160-0x00000000010C0000-0x000000000114F000-memory.dmp
                        Filesize

                        572KB

                      • memory/1828-159-0x0000000000940000-0x000000000096D000-memory.dmp
                        Filesize

                        180KB

                      • memory/1828-157-0x00000000003C0000-0x00000000003C7000-memory.dmp
                        Filesize

                        28KB

                      • memory/1828-158-0x0000000001390000-0x00000000016DA000-memory.dmp
                        Filesize

                        3.3MB

                      • memory/3080-149-0x0000000002900000-0x0000000002AA4000-memory.dmp
                        Filesize

                        1.6MB

                      • memory/3080-163-0x0000000007C10000-0x0000000007D80000-memory.dmp
                        Filesize

                        1.4MB

                      • memory/3080-161-0x0000000007C10000-0x0000000007D80000-memory.dmp
                        Filesize

                        1.4MB

                      • memory/3576-133-0x0000000005920000-0x0000000005EC4000-memory.dmp
                        Filesize

                        5.6MB

                      • memory/3576-134-0x0000000005410000-0x00000000054AC000-memory.dmp
                        Filesize

                        624KB

                      • memory/3576-132-0x00000000008F0000-0x000000000094A000-memory.dmp
                        Filesize

                        360KB

                      • memory/5108-140-0x0000000004ED0000-0x00000000054F8000-memory.dmp
                        Filesize

                        6.2MB

                      • memory/5108-150-0x0000000005BF0000-0x0000000005C0E000-memory.dmp
                        Filesize

                        120KB

                      • memory/5108-136-0x00000000022B0000-0x00000000022E6000-memory.dmp
                        Filesize

                        216KB

                      • memory/5108-135-0x0000000000000000-mapping.dmp
                      • memory/5108-146-0x0000000005500000-0x0000000005566000-memory.dmp
                        Filesize

                        408KB

                      • memory/5108-145-0x0000000005570000-0x00000000055D6000-memory.dmp
                        Filesize

                        408KB

                      • memory/5108-144-0x0000000004E10000-0x0000000004E32000-memory.dmp
                        Filesize

                        136KB

                      • memory/5108-153-0x0000000006100000-0x0000000006122000-memory.dmp
                        Filesize

                        136KB

                      • memory/5108-151-0x0000000006130000-0x00000000061C6000-memory.dmp
                        Filesize

                        600KB

                      • memory/5108-152-0x00000000060B0000-0x00000000060CA000-memory.dmp
                        Filesize

                        104KB