Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28-10-2022 14:47

General

  • Target

    file.exe

  • Size

    225KB

  • MD5

    3359916b838254bede2336070d99b6e5

  • SHA1

    ae40ca0d6b91624cd8d9ef1b30e1ce2338c3309f

  • SHA256

    37fc27ae593c57c90608af9929d7ade4fc5924ec4e795c445c4bf8a5a1bf8585

  • SHA512

    989e405e72f4be4abcca21e8b8cb84b37165e00a88a13f3186801f0f64be8c6a7e70d069e69dfb58f71622a6b41b5c9a93d20279e4a3c580f3e2f488d59a7406

  • SSDEEP

    3072:qUJoFfWzzl+cSM2wPddXssJXKAI95ibwrhlikpXbeK3eMmR6M3vcJLSmKqcHKrF+:qweEp2KjV5IDiErh7bNmv0JLlcHKrF+T

Malware Config

Extracted

Family

formbook

Campaign

f4ca

Decoy

omFHB5ajfJi1UEIEV9XcoRw=

UBjJkmQPyprdhcFF/bdCWQ==

evGKkBUj1je+otcfpw==

KgvGVeOATSt3nug0BIOm2JvOQycB

Lv6o3K0r9aSjI0lr9fg1txw=

LH1jJb/HieQpsEdqWCQTvX2PmsDVIeg=

99dte0XauJfk6Xv+uQxJFgA1gMktBA==

21FkkGB9gMniDQw2ffu6

r4lKBM/q6TZwVZfS

F+14qHeVWi56KdQ=

BgWXRsVoICMvvQ==

I+EozFl0Uy56KdQ=

xoXCgEllKEbWfjFCCLo=

qo9G1lXvvGt5GkxrLQWw

ORNlYic0PJ2ip4geEFSv

Yj+GFpvFxy0uVYx1fLI/XQ==

XL+veIKPjOTe4fjvFs+n

D2JKVAfuakXCAyoEvw==

voWJU81tH56wvt/vImbCcgVd

dVEcwFrmb8bZ4vXvFs+n

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Users\Admin\AppData\Local\Temp\xxrkypy.exe
        "C:\Users\Admin\AppData\Local\Temp\xxrkypy.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\Users\Admin\AppData\Local\Temp\xxrkypy.exe
          "C:\Users\Admin\AppData\Local\Temp\xxrkypy.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1112
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1988

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\uygpu.qh
      Filesize

      5KB

      MD5

      8e97c83dc389c1fa5dc9cdceacf4d4b5

      SHA1

      4c143609bfea2efba4aedcdc7e31fc53e1ecd94c

      SHA256

      008753e08eb498464a40205664506c9f18098b67fbcabafd873aeded7ad44425

      SHA512

      fe99141853e49ef0a1d893667770f26ea13c344dc6b7a43cbc23cd441a8fdbdd704a25dcfe7533c65792c8a1bc93f792a460490fbf79fe465dd528244f59e415

    • C:\Users\Admin\AppData\Local\Temp\uzqdeuvsss.y
      Filesize

      185KB

      MD5

      000956d9b032dd95819bf1da8acdfa35

      SHA1

      cc84b73cbca09be962fc20203017706459f757a3

      SHA256

      eb97119a88606e5e8cdae66a53b8fe44c3143b0f629ea54e4ca0103aeb121535

      SHA512

      d6dedd8852bd63f8eef55c7070fbd851c58d647be359a005bf801dc702c34abafc2275e9c28371431967763d948b95328a1cee94fb7652bf832cea2a2651aebd

    • C:\Users\Admin\AppData\Local\Temp\xxrkypy.exe
      Filesize

      5KB

      MD5

      818e4839cf473064fde652fb001fcce6

      SHA1

      b051185eddc6992bd0b4092e338ed067487af57a

      SHA256

      72eefcdcbb8c9510a83e9ce80810d84688416ede5d4041aee4944f04b7cb903b

      SHA512

      9b8aa6a9ef6d125f80ef555429d45e970f873440d95ac8f687a2ff782d46fdf71c8b66d351010346b989fbeb74f815e96b774a6c463aa9e974399e9a67e50c06

    • C:\Users\Admin\AppData\Local\Temp\xxrkypy.exe
      Filesize

      5KB

      MD5

      818e4839cf473064fde652fb001fcce6

      SHA1

      b051185eddc6992bd0b4092e338ed067487af57a

      SHA256

      72eefcdcbb8c9510a83e9ce80810d84688416ede5d4041aee4944f04b7cb903b

      SHA512

      9b8aa6a9ef6d125f80ef555429d45e970f873440d95ac8f687a2ff782d46fdf71c8b66d351010346b989fbeb74f815e96b774a6c463aa9e974399e9a67e50c06

    • C:\Users\Admin\AppData\Local\Temp\xxrkypy.exe
      Filesize

      5KB

      MD5

      818e4839cf473064fde652fb001fcce6

      SHA1

      b051185eddc6992bd0b4092e338ed067487af57a

      SHA256

      72eefcdcbb8c9510a83e9ce80810d84688416ede5d4041aee4944f04b7cb903b

      SHA512

      9b8aa6a9ef6d125f80ef555429d45e970f873440d95ac8f687a2ff782d46fdf71c8b66d351010346b989fbeb74f815e96b774a6c463aa9e974399e9a67e50c06

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll
      Filesize

      902KB

      MD5

      50338cc1fa2582fa0cad8a8fa7ceb4d2

      SHA1

      ae697ef05b6bec38fb79ff4512ae50a303dcdbce

      SHA256

      0815a80fa73286d8c6bf0982471c61833821d9f10a20612deaa134562e7a3cda

      SHA512

      02a006e26b1d08cb53a4b3dab23ce6a6756a7275f8b3ef00b7412f10cff75411685a3542c5dc330dad7c9f7ff26288a2e94254d00bf53c1394e7252e000c9a61

    • \Users\Admin\AppData\Local\Temp\xxrkypy.exe
      Filesize

      5KB

      MD5

      818e4839cf473064fde652fb001fcce6

      SHA1

      b051185eddc6992bd0b4092e338ed067487af57a

      SHA256

      72eefcdcbb8c9510a83e9ce80810d84688416ede5d4041aee4944f04b7cb903b

      SHA512

      9b8aa6a9ef6d125f80ef555429d45e970f873440d95ac8f687a2ff782d46fdf71c8b66d351010346b989fbeb74f815e96b774a6c463aa9e974399e9a67e50c06

    • \Users\Admin\AppData\Local\Temp\xxrkypy.exe
      Filesize

      5KB

      MD5

      818e4839cf473064fde652fb001fcce6

      SHA1

      b051185eddc6992bd0b4092e338ed067487af57a

      SHA256

      72eefcdcbb8c9510a83e9ce80810d84688416ede5d4041aee4944f04b7cb903b

      SHA512

      9b8aa6a9ef6d125f80ef555429d45e970f873440d95ac8f687a2ff782d46fdf71c8b66d351010346b989fbeb74f815e96b774a6c463aa9e974399e9a67e50c06

    • memory/860-74-0x0000000001F70000-0x0000000002273000-memory.dmp
      Filesize

      3.0MB

    • memory/860-70-0x0000000000000000-mapping.dmp
    • memory/860-77-0x00000000000D0000-0x00000000000FD000-memory.dmp
      Filesize

      180KB

    • memory/860-75-0x00000000009C0000-0x0000000000A4F000-memory.dmp
      Filesize

      572KB

    • memory/860-72-0x0000000000160000-0x000000000016E000-memory.dmp
      Filesize

      56KB

    • memory/860-73-0x00000000000D0000-0x00000000000FD000-memory.dmp
      Filesize

      180KB

    • memory/1112-67-0x0000000000700000-0x0000000000A03000-memory.dmp
      Filesize

      3.0MB

    • memory/1112-68-0x00000000001C0000-0x00000000001D0000-memory.dmp
      Filesize

      64KB

    • memory/1112-63-0x00000000004012B0-mapping.dmp
    • memory/1112-66-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1112-65-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1256-69-0x0000000004980000-0x0000000004AA7000-memory.dmp
      Filesize

      1.2MB

    • memory/1256-76-0x0000000006550000-0x0000000006626000-memory.dmp
      Filesize

      856KB

    • memory/1256-78-0x0000000006550000-0x0000000006626000-memory.dmp
      Filesize

      856KB

    • memory/1912-54-0x00000000763F1000-0x00000000763F3000-memory.dmp
      Filesize

      8KB

    • memory/2000-56-0x0000000000000000-mapping.dmp