Analysis

  • max time kernel
    151s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2022 16:02

General

  • Target

    tmp.exe

  • Size

    342KB

  • MD5

    7569ad8644074e28a6a9dba38e67b95a

  • SHA1

    10e73d912b5a6955161213a5f9004988ca4030ac

  • SHA256

    15eb688bffed96b0b324724e48b258dc6c6deb76d71310b26b01e1e12f26108c

  • SHA512

    15fe965c6e8abeff8f9b064122be640a78ca459a45c06f0f99150f979909208ca66693fc96808dca007670a3ace96f32b375b6a591efdb10dc9d9e8b824cb3ae

  • SSDEEP

    6144:+wN/Qnu418i2BYc5lUeE+zjevK5FV0L3Tzz6oVCVdKrLWeuJavoJ8L:+O/Au4j0Yc5lUJXveUCi/f/

Malware Config

Extracted

Family

formbook

Campaign

f4ca

Decoy

QYZ6iE9Y+CsiZpCBareS0uU=

N2FQLAaH6xXE

Vc6t0MQXN+Llxsqg

ElBedmSvYGGm6yLDhHqzAtmlCxWl

4VpIWShqHR5cpjfQ4bs=

mepO9miu/iFiQQ==

Z8Owqh54IlwEpDfQ4bs=

qcq4uT5HecWZG3EVwKTiUE7slrGQGiyo

IaYYoJikKDDqgV/NigZCLA==

4Xz5pfoCCW/76NnOUrFEOw==

xiijSkVJ3Yuh9OKDcmui/d2lCxWl

cr8MmfpCEu0ULsO3p6w=

JLm2yKHo7hdVb8O3p6w=

Hriy5svWm2Qfq9mPQib9jJI65gOr

2G3nkRpidunlxsqg

gPHUAeXmi8Q9ARy3

6l5WaOf8BxhQDkp5gKQ=

KHHiXs4WOqXZdPhpaw==

+UQ5Vz5O0Ms9ARy3

pNQygKu0OziAvjOHRGLnJA==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\tmp.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%'
        3⤵
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:968
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:740
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Gathers network information
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:880

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Command-Line Interface

    1
    T1059

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll
      Filesize

      902KB

      MD5

      50338cc1fa2582fa0cad8a8fa7ceb4d2

      SHA1

      ae697ef05b6bec38fb79ff4512ae50a303dcdbce

      SHA256

      0815a80fa73286d8c6bf0982471c61833821d9f10a20612deaa134562e7a3cda

      SHA512

      02a006e26b1d08cb53a4b3dab23ce6a6756a7275f8b3ef00b7412f10cff75411685a3542c5dc330dad7c9f7ff26288a2e94254d00bf53c1394e7252e000c9a61

    • memory/740-67-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/740-70-0x0000000000B10000-0x0000000000E13000-memory.dmp
      Filesize

      3.0MB

    • memory/740-71-0x0000000000080000-0x0000000000090000-memory.dmp
      Filesize

      64KB

    • memory/740-68-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/740-60-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/740-61-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/740-63-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/740-64-0x00000000004012B0-mapping.dmp
    • memory/740-66-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/968-69-0x0000000073F00000-0x00000000744AB000-memory.dmp
      Filesize

      5.7MB

    • memory/968-73-0x0000000073F00000-0x00000000744AB000-memory.dmp
      Filesize

      5.7MB

    • memory/968-58-0x0000000000000000-mapping.dmp
    • memory/1204-82-0x0000000007360000-0x0000000007474000-memory.dmp
      Filesize

      1.1MB

    • memory/1204-80-0x0000000007360000-0x0000000007474000-memory.dmp
      Filesize

      1.1MB

    • memory/1204-72-0x0000000004F00000-0x0000000005044000-memory.dmp
      Filesize

      1.3MB

    • memory/1716-74-0x0000000000000000-mapping.dmp
    • memory/1716-76-0x0000000000650000-0x000000000065A000-memory.dmp
      Filesize

      40KB

    • memory/1716-78-0x0000000001F80000-0x0000000002283000-memory.dmp
      Filesize

      3.0MB

    • memory/1716-77-0x0000000000080000-0x00000000000AD000-memory.dmp
      Filesize

      180KB

    • memory/1716-79-0x0000000001DF0000-0x0000000001E7F000-memory.dmp
      Filesize

      572KB

    • memory/1716-81-0x0000000000080000-0x00000000000AD000-memory.dmp
      Filesize

      180KB

    • memory/1768-56-0x0000000075931000-0x0000000075933000-memory.dmp
      Filesize

      8KB

    • memory/1768-57-0x00000000006A0000-0x00000000006BC000-memory.dmp
      Filesize

      112KB

    • memory/1768-54-0x00000000002C0000-0x000000000031A000-memory.dmp
      Filesize

      360KB

    • memory/1768-55-0x00000000003C0000-0x000000000040A000-memory.dmp
      Filesize

      296KB