Analysis
- max time kernel
173s - max time network
174s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
14/10/2022, 19:02
General
- Target tmp.exe
- Size 1.0MB
- Sample221014-xp84gsebgp
- SHA256 1046455f39dbe56dc8cc160ebc53b5b32315021af4a871c06235a5257e02f123
Malware Config
Extracted
-
formbook
-
s8gw
-
b/iFndOEL2rKvw==
-
HK7quAepCJH6CkNgpH2cDYx1
-
YEayMA+cR1WQ0Qw/lQ==
-
kPVNVkAC6pEPHVFQnzCxsA==
-
yLE1wrE7kf1KRGRm5a95qQ==
-
D6ktQZWoaOJGopmOlg==
-
98rmMok6y5e47YvCCMQNPaqM6qf+7PsEAQ==
-
7Po3fdN1NNtop0X5Ryv9PnUrSLQ=
-
+vk1DU92V465rf1+gFhdWMFoAsAY
-
AuhZ6jw45aHmPdzGVilx
-
/9ln8smKekiYzqePkA==
-
7+gsdtTlpqcSL0/GVilx
-
6pXLEOumjAfvK8Y=
-
inT5kfC0FBmcw/hw7NYua819
-
wb/qKZCjfrEiKFz9Vyn9chrZxA==
-
Pil1K4a6ruUXJ2fPD5qXo+2pNMn5VdCREA==
-
mxo3/mBm1hMSWd8=
-
8ltzwIsdiPpJXbK30JecDYx1
-
BmrK2y9G+VyimqzrK9YtmYY=
-
jPP9Q/IqWt3JQSZtvqI1jb9oAsAY
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1288-66-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1288-68-0x0000000000150000-0x0000000000160000-memory.dmp
memory/1288-67-0x0000000000A20000-0x0000000000D23000-memory.dmp
memory/1288-60-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1288-61-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1288-63-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1420-78-0x00000000070F0000-0x0000000007218000-memory.dmp
memory/1420-76-0x00000000070F0000-0x0000000007218000-memory.dmp
memory/1420-69-0x0000000006B70000-0x0000000006CD9000-memory.dmp
memory/1448-59-0x00000000004D0000-0x0000000000502000-memory.dmp
memory/1448-54-0x0000000000F10000-0x0000000001018000-memory.dmp
memory/1448-58-0x0000000005560000-0x00000000055EC000-memory.dmp
memory/1448-57-0x0000000000620000-0x000000000062C000-memory.dmp
memory/1448-56-0x00000000005C0000-0x00000000005DA000-memory.dmp
memory/1448-55-0x0000000076121000-0x0000000076123000-memory.dmp
memory/1756-71-0x000000004A3C0000-0x000000004A40C000-memory.dmp
memory/1756-72-0x0000000000080000-0x00000000000AB000-memory.dmp
memory/1756-73-0x0000000002110000-0x0000000002413000-memory.dmp
memory/1756-75-0x0000000001E40000-0x0000000001ECF000-memory.dmp
memory/1756-77-0x0000000000080000-0x00000000000AB000-memory.dmp