Analysis
- max time kernel
145s - max time network
153s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
- submitted
24/10/2022, 16:03
General
- Target Doc24102022.87654567898765.exe
- Size 824KB
- Sample221024-thb9dsheg5
- SHA256 736808fef49ea666d160c9943b624f0ad79c3d10c44b8042a602d8a31d2465a3
Malware Config
Extracted
-
formbook
-
s5zx
-
wMAY83Xf8pYlwmcLm5HvBdaL
-
CEtcpyGISM/CVFQ5zam3
-
jQE/nMmnXlmcTVQ5zam3
-
kUtRVpN/YY33wLfac81TKg==
-
WxtrRs8s52o/GPsPog==
-
w8LUN0UWABcTD1Hv
-
pCU+Wnk+6/E08im2Xo5y7uea
-
4o2dnKCJNOgbwud9JfMHrMJuAGI+fg==
-
AbPNtFXXpcoeyWB1WGC/AOiS
-
5Kbo75EKwcLiArHSoc/SIg==
-
IaICXWtqc2xvU++OXEd+tRitdw==
-
x0M6GKkDC8SPQGd/S61UdfgVZLqVDFg=
-
Y6TEJKsC3IxVJN986uJugqNcN7NO5EU=
-
rltiOepgaw3Mk0Lbt1yoxuA=
-
z94mjMxyFcLUu1Q=
-
xH3F3Hz93BCSMuBtI65JGm+VN3xm
-
+GO142npuuptGPsPog==
-
WX/VsE7R0FTm3Ju2ema/AOiS
-
qam0OKkfCyE6ZKxZtQ==
-
0ojGr0OMV9khz+4GoA==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Doc24102022.87654567898765.exe"C:\Users\Admin\AppData\Local\Temp\Doc24102022.87654567898765.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Doc24102022.87654567898765.exe"C:\Users\Admin\AppData\Local\Temp\Doc24102022.87654567898765.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
sqlite3.dll
memory/528-74-0x00000000008A0000-0x00000000008B8000-memory.dmp
memory/528-75-0x0000000000080000-0x00000000000AD000-memory.dmp
memory/528-76-0x0000000001F90000-0x0000000002293000-memory.dmp
memory/528-77-0x0000000001DD0000-0x0000000001E5F000-memory.dmp
memory/528-79-0x0000000000080000-0x00000000000AD000-memory.dmp
memory/1340-58-0x0000000005D60000-0x0000000005DD0000-memory.dmp
memory/1340-54-0x00000000000A0000-0x0000000000174000-memory.dmp
memory/1340-59-0x0000000004880000-0x00000000048B4000-memory.dmp
memory/1340-57-0x0000000000510000-0x000000000051C000-memory.dmp
memory/1340-56-0x0000000000760000-0x0000000000776000-memory.dmp
memory/1340-55-0x00000000758B1000-0x00000000758B3000-memory.dmp
memory/1392-80-0x00000000038F0000-0x000000000398C000-memory.dmp
memory/1392-78-0x00000000038F0000-0x000000000398C000-memory.dmp
memory/1392-71-0x0000000004CB0000-0x0000000004D91000-memory.dmp
memory/1412-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1412-70-0x00000000001F0000-0x0000000000200000-memory.dmp
memory/1412-68-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1412-69-0x0000000000960000-0x0000000000C63000-memory.dmp
memory/1412-67-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1412-66-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1412-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1412-61-0x0000000000400000-0x000000000042F000-memory.dmp