Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-10-2022 19:21

General

  • Target

    tmp.exe

  • Size

    342KB

  • MD5

    7569ad8644074e28a6a9dba38e67b95a

  • SHA1

    10e73d912b5a6955161213a5f9004988ca4030ac

  • SHA256

    15eb688bffed96b0b324724e48b258dc6c6deb76d71310b26b01e1e12f26108c

  • SHA512

    15fe965c6e8abeff8f9b064122be640a78ca459a45c06f0f99150f979909208ca66693fc96808dca007670a3ace96f32b375b6a591efdb10dc9d9e8b824cb3ae

  • SSDEEP

    6144:+wN/Qnu418i2BYc5lUeE+zjevK5FV0L3Tzz6oVCVdKrLWeuJavoJ8L:+O/Au4j0Yc5lUJXveUCi/f/

Malware Config

Extracted

Family

formbook

Campaign

f4ca

Decoy

QYZ6iE9Y+CsiZpCBareS0uU=

N2FQLAaH6xXE

Vc6t0MQXN+Llxsqg

ElBedmSvYGGm6yLDhHqzAtmlCxWl

4VpIWShqHR5cpjfQ4bs=

mepO9miu/iFiQQ==

Z8Owqh54IlwEpDfQ4bs=

qcq4uT5HecWZG3EVwKTiUE7slrGQGiyo

IaYYoJikKDDqgV/NigZCLA==

4Xz5pfoCCW/76NnOUrFEOw==

xiijSkVJ3Yuh9OKDcmui/d2lCxWl

cr8MmfpCEu0ULsO3p6w=

JLm2yKHo7hdVb8O3p6w=

Hriy5svWm2Qfq9mPQib9jJI65gOr

2G3nkRpidunlxsqg

gPHUAeXmi8Q9ARy3

6l5WaOf8BxhQDkp5gKQ=

KHHiXs4WOqXZdPhpaw==

+UQ5Vz5O0Ms9ARy3

pNQygKu0OziAvjOHRGLnJA==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4912
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\tmp.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%'
        3⤵
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4192
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
          PID:4140
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:3848
      • C:\Windows\SysWOW64\cmmon32.exe
        "C:\Windows\SysWOW64\cmmon32.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3256
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:3852

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3048-151-0x00000000031D0000-0x0000000003344000-memory.dmp
        Filesize

        1.5MB

      • memory/3048-164-0x00000000084D0000-0x00000000085C1000-memory.dmp
        Filesize

        964KB

      • memory/3048-162-0x00000000084D0000-0x00000000085C1000-memory.dmp
        Filesize

        964KB

      • memory/3256-163-0x00000000006D0000-0x00000000006FD000-memory.dmp
        Filesize

        180KB

      • memory/3256-161-0x00000000023F0000-0x000000000247F000-memory.dmp
        Filesize

        572KB

      • memory/3256-160-0x0000000002660000-0x00000000029AA000-memory.dmp
        Filesize

        3.3MB

      • memory/3256-158-0x00000000003B0000-0x00000000003BC000-memory.dmp
        Filesize

        48KB

      • memory/3256-159-0x00000000006D0000-0x00000000006FD000-memory.dmp
        Filesize

        180KB

      • memory/3256-155-0x0000000000000000-mapping.dmp
      • memory/3848-138-0x0000000000000000-mapping.dmp
      • memory/3848-140-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/3848-145-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/3848-146-0x0000000000401000-0x000000000042F000-memory.dmp
        Filesize

        184KB

      • memory/3848-147-0x0000000001170000-0x00000000014BA000-memory.dmp
        Filesize

        3.3MB

      • memory/3848-157-0x0000000000401000-0x000000000042F000-memory.dmp
        Filesize

        184KB

      • memory/3848-150-0x0000000000B60000-0x0000000000B70000-memory.dmp
        Filesize

        64KB

      • memory/3848-156-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/4140-137-0x0000000000000000-mapping.dmp
      • memory/4192-154-0x0000000006A90000-0x0000000006AB2000-memory.dmp
        Filesize

        136KB

      • memory/4192-153-0x0000000006A10000-0x0000000006A2A000-memory.dmp
        Filesize

        104KB

      • memory/4192-143-0x0000000005E40000-0x0000000005EA6000-memory.dmp
        Filesize

        408KB

      • memory/4192-152-0x00000000077D0000-0x0000000007866000-memory.dmp
        Filesize

        600KB

      • memory/4192-142-0x0000000005570000-0x0000000005592000-memory.dmp
        Filesize

        136KB

      • memory/4192-149-0x0000000006540000-0x000000000655E000-memory.dmp
        Filesize

        120KB

      • memory/4192-139-0x0000000005710000-0x0000000005D38000-memory.dmp
        Filesize

        6.2MB

      • memory/4192-144-0x0000000005F20000-0x0000000005F86000-memory.dmp
        Filesize

        408KB

      • memory/4192-136-0x0000000004F80000-0x0000000004FB6000-memory.dmp
        Filesize

        216KB

      • memory/4192-135-0x0000000000000000-mapping.dmp
      • memory/4912-132-0x0000000000220000-0x000000000027A000-memory.dmp
        Filesize

        360KB

      • memory/4912-134-0x0000000004E10000-0x0000000004EAC000-memory.dmp
        Filesize

        624KB

      • memory/4912-133-0x00000000053C0000-0x0000000005964000-memory.dmp
        Filesize

        5.6MB