Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    15-11-2022 18:23

General

  • Target

    Nov SOA 2022.exe

  • Size

    613KB

  • MD5

    184e673227622ce88710a66d010aefed

  • SHA1

    cad11b3ca935aaefaeab3f59f407b4cc030d9e21

  • SHA256

    345cb40f4372dc796b5f7ee68e9f6d19a6c046db457704d800eacb717e6fddd9

  • SHA512

    6aa3a2048dbdd0dfe85af46dbb4cc464a8f54486dcb08acf53f6f1e547cef0d1f459a2ab93cdce1142022df813d36f32a888f5e84074b3177c5e517eb54f3ba4

  • SSDEEP

    12288:J8F2oSGnyz/ftNHWaRfDobiiZUFU0EbqB0RNFngXiJ/Gfk34vyC1Q07kyLL1XXMQ:iGGnyzXtBTfDobdZEUL2alDJ/GcViRon

Malware Config

Extracted

Family

formbook

Campaign

n2hm

Decoy

XCeG4IxNKbAl

YzJWbnC+El84nA==

KAJcdmP8yEcO5LXPCFF42Wfb

I+J+xYO95GJQWVU=

GtgxPPv3FmQmhw==

Og9NYF4xEl+j7vGTR93xvg==

506Cg07bsT0G6yK+A96H0h35V+JLkwI=

wAYXFN+pSFIXgQ==

ijzLI/f+FmQmhw==

UfT2PweNm+w8

GQWVw5aZnfF/kS5e

30BKYjua9zcA7gAwsPUngLnjyrBNEgo=

AM65OrmyFmQmhw==

VSlTVxISZ4J/kS5e

GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==

B9H98cUUfX+AWOqiTA==

MxVffWOIoVnM37zrd2sTaOY=

z6bxCgG/mGhR7oDzQA==

pQgSLSRi6AK3M/PdArpX

6rRRsYuSnXx/kS5e

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\Nov SOA 2022.exe
      "C:\Users\Admin\AppData\Local\Temp\Nov SOA 2022.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Users\Admin\AppData\Local\Temp\Nov SOA 2022.exe
        "C:\Users\Admin\AppData\Local\Temp\Nov SOA 2022.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2044
        • C:\Windows\SysWOW64\autoconv.exe
          "C:\Windows\SysWOW64\autoconv.exe"
          4⤵
            PID:1700
          • C:\Windows\SysWOW64\wscript.exe
            "C:\Windows\SysWOW64\wscript.exe"
            4⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:580
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              5⤵
                PID:1824

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Collection

      Data from Local System

      1
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Local\Temp\sqlite3.dll
        Filesize

        849KB

        MD5

        87f9e5a6318ac1ec5ee05aa94a919d7a

        SHA1

        7a9956e8de89603dba99772da29493d3fd0fe37d

        SHA256

        7705b87603e0d772e1753441001fcf1ac2643ee41bf14a8177de2c056628665c

        SHA512

        c45c03176142918e34f746711e83384572bd6a8ed0a005600aa4a18cf22eade06c76eda190b37db49ec1971c4649e086affd19eee108c5f405df27c0c8cb23d2

      • memory/580-83-0x0000000000070000-0x000000000009D000-memory.dmp
        Filesize

        180KB

      • memory/580-75-0x0000000000000000-mapping.dmp
      • memory/580-78-0x0000000000E20000-0x0000000000E46000-memory.dmp
        Filesize

        152KB

      • memory/580-79-0x0000000000B00000-0x0000000000E03000-memory.dmp
        Filesize

        3.0MB

      • memory/580-80-0x0000000000070000-0x000000000009D000-memory.dmp
        Filesize

        180KB

      • memory/580-81-0x00000000009E0000-0x0000000000A6F000-memory.dmp
        Filesize

        572KB

      • memory/1212-85-0x0000000007570000-0x00000000076FE000-memory.dmp
        Filesize

        1.6MB

      • memory/1212-74-0x0000000004CB0000-0x0000000004E1E000-memory.dmp
        Filesize

        1.4MB

      • memory/1212-82-0x0000000007570000-0x00000000076FE000-memory.dmp
        Filesize

        1.6MB

      • memory/1212-71-0x0000000004BB0000-0x0000000004CAA000-memory.dmp
        Filesize

        1000KB

      • memory/1688-54-0x0000000000B00000-0x0000000000BA0000-memory.dmp
        Filesize

        640KB

      • memory/1688-59-0x0000000000A10000-0x0000000000A56000-memory.dmp
        Filesize

        280KB

      • memory/1688-58-0x0000000005CB0000-0x0000000005D30000-memory.dmp
        Filesize

        512KB

      • memory/1688-57-0x0000000000390000-0x000000000039C000-memory.dmp
        Filesize

        48KB

      • memory/1688-56-0x00000000004F0000-0x0000000000508000-memory.dmp
        Filesize

        96KB

      • memory/1688-55-0x0000000075601000-0x0000000075603000-memory.dmp
        Filesize

        8KB

      • memory/2044-61-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/2044-73-0x0000000000190000-0x00000000001A0000-memory.dmp
        Filesize

        64KB

      • memory/2044-76-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/2044-77-0x0000000000401000-0x000000000042F000-memory.dmp
        Filesize

        184KB

      • memory/2044-70-0x0000000000150000-0x0000000000160000-memory.dmp
        Filesize

        64KB

      • memory/2044-69-0x0000000000BA0000-0x0000000000EA3000-memory.dmp
        Filesize

        3.0MB

      • memory/2044-68-0x0000000000401000-0x000000000042F000-memory.dmp
        Filesize

        184KB

      • memory/2044-67-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/2044-66-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/2044-64-0x00000000004012B0-mapping.dmp
      • memory/2044-63-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/2044-60-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB