Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
15/11/2022, 20:03
General
- Target Nov SOA 2022.exe
- Size 867KB
- Sample221115-ysnsdsbe2z
- SHA256 5e4cdb1fe04c466a44dce83bc1e48ccfcf9f8e6baf9a989815642bc9b8950ce8
Malware Config
Extracted
-
formbook
-
n2hm
-
XCeG4IxNKbAl
-
YzJWbnC+El84nA==
-
KAJcdmP8yEcO5LXPCFF42Wfb
-
I+J+xYO95GJQWVU=
-
GtgxPPv3FmQmhw==
-
Og9NYF4xEl+j7vGTR93xvg==
-
506Cg07bsT0G6yK+A96H0h35V+JLkwI=
-
wAYXFN+pSFIXgQ==
-
ijzLI/f+FmQmhw==
-
UfT2PweNm+w8
-
GQWVw5aZnfF/kS5e
-
30BKYjua9zcA7gAwsPUngLnjyrBNEgo=
-
AM65OrmyFmQmhw==
-
VSlTVxISZ4J/kS5e
-
GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==
-
B9H98cUUfX+AWOqiTA==
-
MxVffWOIoVnM37zrd2sTaOY=
-
z6bxCgG/mGhR7oDzQA==
-
pQgSLSRi6AK3M/PdArpX
-
6rRRsYuSnXx/kS5e
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nov SOA 2022.exe"C:\Users\Admin\AppData\Local\Temp\Nov SOA 2022.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nov SOA 2022.exe"C:\Users\Admin\AppData\Local\Temp\Nov SOA 2022.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1424-144-0x0000000000E00000-0x0000000000E10000-memory.dmp
memory/1424-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1424-148-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1424-147-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1424-143-0x0000000001100000-0x000000000144A000-memory.dmp
memory/1424-138-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1424-141-0x0000000000401000-0x000000000042F000-memory.dmp
memory/2492-145-0x0000000003540000-0x0000000003606000-memory.dmp
memory/2492-153-0x0000000003440000-0x000000000350E000-memory.dmp
memory/2492-155-0x0000000003440000-0x000000000350E000-memory.dmp
memory/2560-152-0x00000000023B0000-0x000000000243F000-memory.dmp
memory/2560-149-0x0000000000EA0000-0x0000000000EB2000-memory.dmp
memory/2560-151-0x0000000002480000-0x00000000027CA000-memory.dmp
memory/2560-150-0x0000000000360000-0x000000000038D000-memory.dmp
memory/2560-154-0x0000000000360000-0x000000000038D000-memory.dmp
memory/3332-136-0x0000000008E10000-0x0000000008EAC000-memory.dmp
memory/3332-135-0x00000000054B0000-0x00000000054BA000-memory.dmp
memory/3332-134-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/3332-132-0x0000000000500000-0x00000000005E0000-memory.dmp
memory/3332-133-0x00000000055C0000-0x0000000005B64000-memory.dmp