Analysis
- max time kernel
150s - max time network
152s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
07/10/2022, 09:31
General
- Target Receipts.exe
- Size 952KB
- Sample221007-lg2tnaccdk
- SHA256 73f74f1aec6f93a54aeb2da104556dfd49eeb747a4d88ef3cf9d2bed4ad41b70
Malware Config
Extracted
-
formbook
-
49id
-
Lx+qn+IuFHrpYw4aLjqrV0s=
-
oTFyf7DpzDr0CxnANoHd0ZVn/P8=
-
trcX/OnzxdkmnRMQYog=
-
bAVbrILTo2dyzVNRlZs=
-
iAt82zY2FbeLnZ8ehqD3sK3DSc/7
-
RthInWSwiITUYAQES3n0
-
HqXZ8LT4ijH4
-
4b3T7LD8lizy
-
5vB1eWJzRz5Ypzm/NYXPcz5O7f0=
-
cR4+Ihw2Dip6B4MTL5XnkA==
-
7pPqTAFNLJ5iZ4AlY4LXnYc/2KDXVrE=
-
OOZBmRMh+XcG5R3WGjmDKfzDSc/7
-
w9u6j6Eu1IZfM1UZ
-
zEzLU87y1D/by8xuxcvs5JcY
-
PsU4iyYvBf8LYQQES3n0
-
22GzGcX92mw0Hhy89Xng
-
fzOL5pruzSWaYm79VoD14Vvq1w==
-
Ltts7l9lO8GnD4kXL5XnkA==
-
uuw9zZXjqDLEk50zm9Hs5JcY
-
zk+U6pwAzuk5t3QwM3bxhw==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Receipts.exe"C:\Users\Admin\AppData\Local\Temp\Receipts.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Receipts.exe"C:\Users\Admin\AppData\Local\Temp\Receipts.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Receipts.exe"C:\Users\Admin\AppData\Local\Temp\Receipts.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
sqlite3.dll
memory/1200-71-0x00000000049D0000-0x0000000004ADF000-memory.dmp
memory/1200-81-0x0000000004AE0000-0x0000000004C04000-memory.dmp
memory/1200-83-0x0000000004AE0000-0x0000000004C04000-memory.dmp
memory/1512-58-0x0000000005DB0000-0x0000000005E42000-memory.dmp
memory/1512-59-0x0000000004660000-0x0000000004698000-memory.dmp
memory/1512-54-0x0000000000D40000-0x0000000000E32000-memory.dmp
memory/1512-57-0x00000000002E0000-0x00000000002EC000-memory.dmp
memory/1512-56-0x0000000000280000-0x0000000000298000-memory.dmp
memory/1512-55-0x00000000756A1000-0x00000000756A3000-memory.dmp
memory/1752-76-0x0000000075121000-0x0000000075123000-memory.dmp
memory/1752-82-0x00000000000C0000-0x00000000000ED000-memory.dmp
memory/1752-80-0x0000000002270000-0x00000000022FF000-memory.dmp
memory/1752-79-0x0000000002380000-0x0000000002683000-memory.dmp
memory/1752-78-0x00000000000C0000-0x00000000000ED000-memory.dmp
memory/1752-77-0x00000000006D0000-0x0000000000951000-memory.dmp
memory/1956-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1956-75-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1956-73-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1956-70-0x0000000000070000-0x0000000000080000-memory.dmp
memory/1956-67-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1956-69-0x0000000000830000-0x0000000000B33000-memory.dmp
memory/1956-66-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1956-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1956-61-0x0000000000400000-0x000000000042F000-memory.dmp