Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
14/10/2022, 19:02
General
- Target tmp.exe
- Size 1.0MB
- Sample221014-xp84gsebgp
- SHA256 1046455f39dbe56dc8cc160ebc53b5b32315021af4a871c06235a5257e02f123
Malware Config
Extracted
-
formbook
-
s8gw
-
b/iFndOEL2rKvw==
-
HK7quAepCJH6CkNgpH2cDYx1
-
YEayMA+cR1WQ0Qw/lQ==
-
kPVNVkAC6pEPHVFQnzCxsA==
-
yLE1wrE7kf1KRGRm5a95qQ==
-
D6ktQZWoaOJGopmOlg==
-
98rmMok6y5e47YvCCMQNPaqM6qf+7PsEAQ==
-
7Po3fdN1NNtop0X5Ryv9PnUrSLQ=
-
+vk1DU92V465rf1+gFhdWMFoAsAY
-
AuhZ6jw45aHmPdzGVilx
-
/9ln8smKekiYzqePkA==
-
7+gsdtTlpqcSL0/GVilx
-
6pXLEOumjAfvK8Y=
-
inT5kfC0FBmcw/hw7NYua819
-
wb/qKZCjfrEiKFz9Vyn9chrZxA==
-
Pil1K4a6ruUXJ2fPD5qXo+2pNMn5VdCREA==
-
mxo3/mBm1hMSWd8=
-
8ltzwIsdiPpJXbK30JecDYx1
-
BmrK2y9G+VyimqzrK9YtmYY=
-
jPP9Q/IqWt3JQSZtvqI1jb9oAsAY
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1124-144-0x00000000033B0000-0x0000000003517000-memory.dmp
memory/1124-154-0x0000000008C30000-0x0000000008DA0000-memory.dmp
memory/1124-152-0x0000000008C30000-0x0000000008DA0000-memory.dmp
memory/1124-150-0x00000000033B0000-0x0000000003517000-memory.dmp
memory/2060-133-0x0000000005850000-0x0000000005DF4000-memory.dmp
memory/2060-134-0x0000000005380000-0x0000000005412000-memory.dmp
memory/2060-135-0x00000000057A0000-0x00000000057AA000-memory.dmp
memory/2060-136-0x0000000008F60000-0x0000000008FFC000-memory.dmp
memory/2060-137-0x0000000001350000-0x00000000013B6000-memory.dmp
memory/2060-132-0x00000000008C0000-0x00000000009C8000-memory.dmp
memory/4328-147-0x0000000000EF0000-0x0000000000EFB000-memory.dmp
memory/4328-148-0x0000000000130000-0x000000000015B000-memory.dmp
memory/4328-149-0x0000000000B50000-0x0000000000E9A000-memory.dmp
memory/4328-151-0x0000000000A00000-0x0000000000A8F000-memory.dmp
memory/4328-153-0x0000000000130000-0x000000000015B000-memory.dmp
memory/4608-146-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4608-143-0x0000000000F20000-0x0000000000F30000-memory.dmp
memory/4608-141-0x0000000001390000-0x00000000016DA000-memory.dmp
memory/4608-140-0x0000000000400000-0x000000000042B000-memory.dmp