Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05-10-2022 20:57

General

  • Target

    tmp.exe

  • Size

    342KB

  • MD5

    7569ad8644074e28a6a9dba38e67b95a

  • SHA1

    10e73d912b5a6955161213a5f9004988ca4030ac

  • SHA256

    15eb688bffed96b0b324724e48b258dc6c6deb76d71310b26b01e1e12f26108c

  • SHA512

    15fe965c6e8abeff8f9b064122be640a78ca459a45c06f0f99150f979909208ca66693fc96808dca007670a3ace96f32b375b6a591efdb10dc9d9e8b824cb3ae

  • SSDEEP

    6144:+wN/Qnu418i2BYc5lUeE+zjevK5FV0L3Tzz6oVCVdKrLWeuJavoJ8L:+O/Au4j0Yc5lUJXveUCi/f/

Malware Config

Extracted

Family

formbook

Campaign

f4ca

Decoy

QYZ6iE9Y+CsiZpCBareS0uU=

N2FQLAaH6xXE

Vc6t0MQXN+Llxsqg

ElBedmSvYGGm6yLDhHqzAtmlCxWl

4VpIWShqHR5cpjfQ4bs=

mepO9miu/iFiQQ==

Z8Owqh54IlwEpDfQ4bs=

qcq4uT5HecWZG3EVwKTiUE7slrGQGiyo

IaYYoJikKDDqgV/NigZCLA==

4Xz5pfoCCW/76NnOUrFEOw==

xiijSkVJ3Yuh9OKDcmui/d2lCxWl

cr8MmfpCEu0ULsO3p6w=

JLm2yKHo7hdVb8O3p6w=

Hriy5svWm2Qfq9mPQib9jJI65gOr

2G3nkRpidunlxsqg

gPHUAeXmi8Q9ARy3

6l5WaOf8BxhQDkp5gKQ=

KHHiXs4WOqXZdPhpaw==

+UQ5Vz5O0Ms9ARy3

pNQygKu0OziAvjOHRGLnJA==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1352
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:544
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\tmp.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%'
        3⤵
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1696
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:940
        • C:\Windows\SysWOW64\ipconfig.exe
          "C:\Windows\SysWOW64\ipconfig.exe"
          4⤵
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Gathers network information
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:268
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            5⤵
              PID:832

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Command-Line Interface

    1
    T1059

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll
      Filesize

      837KB

      MD5

      e1b58e0aa1b377a1d0e940660ad1ace1

      SHA1

      5afc7291b26855b1252b26381ebc85ed3cca218f

      SHA256

      1b98c006231d38524e2278a474c49274fe42e0bb1a31bcfda02e6e32f559b777

      SHA512

      9ce778bcb586638662b090910c4ceab3b64e16dfaf905a7581c1d349fecdf186995b3cc0dc8c6fc6e9761ea2831d7b14ac1619c2bd5ebc6d18015842e5d94aa2

    • memory/268-77-0x0000000000000000-mapping.dmp
    • memory/268-86-0x0000000000080000-0x00000000000AD000-memory.dmp
      Filesize

      180KB

    • memory/268-84-0x0000000000530000-0x00000000005BF000-memory.dmp
      Filesize

      572KB

    • memory/268-83-0x0000000001EF0000-0x00000000021F3000-memory.dmp
      Filesize

      3.0MB

    • memory/268-82-0x0000000000080000-0x00000000000AD000-memory.dmp
      Filesize

      180KB

    • memory/268-81-0x0000000000AE0000-0x0000000000AEA000-memory.dmp
      Filesize

      40KB

    • memory/544-55-0x0000000000680000-0x00000000006CA000-memory.dmp
      Filesize

      296KB

    • memory/544-56-0x0000000075A91000-0x0000000075A93000-memory.dmp
      Filesize

      8KB

    • memory/544-58-0x00000000005F0000-0x000000000060C000-memory.dmp
      Filesize

      112KB

    • memory/544-54-0x00000000011A0000-0x00000000011FA000-memory.dmp
      Filesize

      360KB

    • memory/940-79-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/940-63-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/940-70-0x0000000000120000-0x0000000000130000-memory.dmp
      Filesize

      64KB

    • memory/940-60-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/940-61-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/940-69-0x0000000000AC0000-0x0000000000DC3000-memory.dmp
      Filesize

      3.0MB

    • memory/940-75-0x00000000001A0000-0x00000000001B0000-memory.dmp
      Filesize

      64KB

    • memory/940-64-0x00000000004012B0-mapping.dmp
    • memory/940-68-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/940-78-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/940-67-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/940-66-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1352-76-0x0000000004C90000-0x0000000004D9E000-memory.dmp
      Filesize

      1.1MB

    • memory/1352-85-0x0000000004DA0000-0x0000000004F03000-memory.dmp
      Filesize

      1.4MB

    • memory/1352-71-0x0000000003F80000-0x0000000004034000-memory.dmp
      Filesize

      720KB

    • memory/1352-87-0x0000000004DA0000-0x0000000004F03000-memory.dmp
      Filesize

      1.4MB

    • memory/1696-73-0x00000000744E0000-0x0000000074A8B000-memory.dmp
      Filesize

      5.7MB

    • memory/1696-72-0x00000000744E0000-0x0000000074A8B000-memory.dmp
      Filesize

      5.7MB

    • memory/1696-57-0x0000000000000000-mapping.dmp