Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
18/10/2022, 14:28
General
- Target payload.exe
- Size 185KB
- Sample221018-rs73psgba7
- SHA256 5017913bca4c5c1eaf5646e3983f9d8fc4e52f4a66406f46f3029952ae1fde70
Malware Config
Extracted
-
formbook
-
knnt
-
65SBubRb0cQTZyel+RrmtuIytWG7hIY=
-
lxY8gZLYuXPYl40/
-
IBCcbQLOUkWVL3cA/DkK2ei+vuKlXA==
-
4Lo6dar405m4hxqWl58sOc0=
-
4KyQBqNrzYWTI6Iv016m7BZVvuKlXA==
-
PyCmasPI0Lj0JTU=
-
hnoGNwDmybXus0PVH2S1Td2l0ZTJ
-
s4CRDagqgmaCo9bOBD4i
-
T5IbS3G46ZbN8RncbsWuAiWl0ZTJ
-
2vxQ/T6e+7vkjz9yriaOpBbO8bYapwAu
-
55558Jha4dgR7PCZrQ==
-
O9KAFJVY3c4V1Xi2rEGne4ZMtSY=
-
ZPih22lkYU3Yl40/
-
mCc1tbkLsWeH
-
MpbgOtnQvGu9jQ==
-
D6uAq4Gdj3UEkzmKkCOIW4BG
-
A3rp8NpDzp2Q
-
4WMaDz2Ff26SfX5xEaABgk0WTQ==
-
G16+qE5AFMf20h0PxfsyLIZMtSY=
-
az44qCVNL8dm2vG/nuEbI3K46HT5K44=
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payload.exe"C:\Users\Admin\AppData\Local\Temp\payload.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/548-137-0x0000000000AD0000-0x0000000000AF7000-memory.dmp
memory/548-138-0x00000000007C0000-0x00000000007ED000-memory.dmp
memory/548-139-0x00000000029D0000-0x0000000002D1A000-memory.dmp
memory/548-140-0x0000000002800000-0x000000000288F000-memory.dmp
memory/548-142-0x00000000007C0000-0x00000000007ED000-memory.dmp
memory/2640-135-0x0000000008D20000-0x0000000008ECA000-memory.dmp
memory/2640-141-0x0000000003480000-0x000000000356A000-memory.dmp
memory/2640-143-0x0000000003480000-0x000000000356A000-memory.dmp
memory/4920-132-0x0000000000830000-0x000000000085F000-memory.dmp
memory/4920-133-0x0000000000FB0000-0x00000000012FA000-memory.dmp
memory/4920-134-0x0000000000820000-0x0000000000830000-memory.dmp