Analysis

  • max time kernel
    176s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2022 16:02

General

  • Target

    tmp.exe

  • Size

    342KB

  • MD5

    7569ad8644074e28a6a9dba38e67b95a

  • SHA1

    10e73d912b5a6955161213a5f9004988ca4030ac

  • SHA256

    15eb688bffed96b0b324724e48b258dc6c6deb76d71310b26b01e1e12f26108c

  • SHA512

    15fe965c6e8abeff8f9b064122be640a78ca459a45c06f0f99150f979909208ca66693fc96808dca007670a3ace96f32b375b6a591efdb10dc9d9e8b824cb3ae

  • SSDEEP

    6144:+wN/Qnu418i2BYc5lUeE+zjevK5FV0L3Tzz6oVCVdKrLWeuJavoJ8L:+O/Au4j0Yc5lUJXveUCi/f/

Malware Config

Extracted

Family

formbook

Campaign

f4ca

Decoy

QYZ6iE9Y+CsiZpCBareS0uU=

N2FQLAaH6xXE

Vc6t0MQXN+Llxsqg

ElBedmSvYGGm6yLDhHqzAtmlCxWl

4VpIWShqHR5cpjfQ4bs=

mepO9miu/iFiQQ==

Z8Owqh54IlwEpDfQ4bs=

qcq4uT5HecWZG3EVwKTiUE7slrGQGiyo

IaYYoJikKDDqgV/NigZCLA==

4Xz5pfoCCW/76NnOUrFEOw==

xiijSkVJ3Yuh9OKDcmui/d2lCxWl

cr8MmfpCEu0ULsO3p6w=

JLm2yKHo7hdVb8O3p6w=

Hriy5svWm2Qfq9mPQib9jJI65gOr

2G3nkRpidunlxsqg

gPHUAeXmi8Q9ARy3

6l5WaOf8BxhQDkp5gKQ=

KHHiXs4WOqXZdPhpaw==

+UQ5Vz5O0Ms9ARy3

pNQygKu0OziAvjOHRGLnJA==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\tmp.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%'
        3⤵
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4496
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3600
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:236
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:4392

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/236-161-0x0000000000D80000-0x0000000000DAD000-memory.dmp
      Filesize

      180KB

    • memory/236-160-0x00000000014E0000-0x000000000156F000-memory.dmp
      Filesize

      572KB

    • memory/236-156-0x0000000000D80000-0x0000000000DAD000-memory.dmp
      Filesize

      180KB

    • memory/236-155-0x0000000001710000-0x0000000001A5A000-memory.dmp
      Filesize

      3.3MB

    • memory/236-154-0x00000000000D0000-0x00000000000E7000-memory.dmp
      Filesize

      92KB

    • memory/236-151-0x0000000000000000-mapping.dmp
    • memory/1652-133-0x0000000005140000-0x00000000056E4000-memory.dmp
      Filesize

      5.6MB

    • memory/1652-134-0x0000000004C30000-0x0000000004CCC000-memory.dmp
      Filesize

      624KB

    • memory/1652-132-0x0000000000090000-0x00000000000EA000-memory.dmp
      Filesize

      360KB

    • memory/2424-149-0x0000000008D50000-0x0000000008EC7000-memory.dmp
      Filesize

      1.5MB

    • memory/2424-163-0x0000000009190000-0x00000000092F6000-memory.dmp
      Filesize

      1.4MB

    • memory/2424-162-0x0000000009190000-0x00000000092F6000-memory.dmp
      Filesize

      1.4MB

    • memory/3600-140-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/3600-147-0x0000000001220000-0x000000000156A000-memory.dmp
      Filesize

      3.3MB

    • memory/3600-148-0x00000000011E0000-0x00000000011F0000-memory.dmp
      Filesize

      64KB

    • memory/3600-136-0x0000000000000000-mapping.dmp
    • memory/3600-137-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/3600-142-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/3600-152-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/3600-153-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/4496-141-0x0000000005A10000-0x0000000006038000-memory.dmp
      Filesize

      6.2MB

    • memory/4496-143-0x0000000005610000-0x0000000005632000-memory.dmp
      Filesize

      136KB

    • memory/4496-145-0x00000000057B0000-0x0000000005816000-memory.dmp
      Filesize

      408KB

    • memory/4496-157-0x00000000077A0000-0x0000000007836000-memory.dmp
      Filesize

      600KB

    • memory/4496-158-0x0000000006C90000-0x0000000006CAA000-memory.dmp
      Filesize

      104KB

    • memory/4496-159-0x0000000006CE0000-0x0000000006D02000-memory.dmp
      Filesize

      136KB

    • memory/4496-139-0x0000000002DB0000-0x0000000002DE6000-memory.dmp
      Filesize

      216KB

    • memory/4496-150-0x00000000067D0000-0x00000000067EE000-memory.dmp
      Filesize

      120KB

    • memory/4496-146-0x0000000005820000-0x0000000005886000-memory.dmp
      Filesize

      408KB

    • memory/4496-135-0x0000000000000000-mapping.dmp