Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-11-2022 06:48

General

  • Target

    vbc.exe

  • Size

    374KB

  • MD5

    7106216b183ca11deba630ff975a53b4

  • SHA1

    6c2c163ffd926ea1f7bd6a8e8169957ee8c47dc3

  • SHA256

    d3b626acf50c671d6bb5baff02df9f99d09b761c9deff6932d0600cbabb27d49

  • SHA512

    6204f56205f38f30f1444f4981a0afb7cc74164aaf8744df2d4324b3c32dbcebb6070299a03927139c74bc078f3970cbd75e3fed27659983dcf51762450bc75a

  • SSDEEP

    6144:MEa0Nv9Es7Gavr2RBjyN0fsi6/bFCEy74GhPun6I2aVjLbIozLgl6mJBkghG7PRS:XNGazUyN0ki6/bF21hm68jLbhg6mJBpn

Malware Config

Extracted

Family

formbook

Campaign

henz

Decoy

IxWMb+jVsoinShuZJzk=

TPfKgQZ//oGnKr/J

EsK0WxD5kY65XOW1Td/5CxSUpCUytR7M

KebSmiCP9p8yUw==

HAt/ljkEuqMLHOLCi53Pv8MKX9qk

CY4ogZTwJc4vSw==

WWDIx5UYUDyepntE0YIAPca3/rI=

+Pkr01Lfb2rME7bL

S5nyK0p8jS2xdwQ=

W/oqvlO57LfkLcLHnQ==

zrrwtqkTLwxulm4l8FGopw==

AqucYext8bzFbOKthIm8E6gfVkUHxKY=

OfnjeDs78+RTcz4OHRl+

XKf1wwpZR5hLLjHgmUGOpQ==

JMyhSLoJPTCwn5o9zX2d8i1+

Wk54MBsDhWSVbnIRkQ==

7aaYR/tOhh9piTw5/KHSRwuK2iqgafw7pQ==

hH/EYxN+jC2xdwQ=

S0F4ORqDjS2xdwQ=

0o/UwXnuJ+sJp0cOHRl+

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Users\Admin\AppData\Local\Temp\vbc.exe
      "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Users\Admin\AppData\Local\Temp\taczgytc.exe
        "C:\Users\Admin\AppData\Local\Temp\taczgytc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4652
        • C:\Users\Admin\AppData\Local\Temp\taczgytc.exe
          "C:\Users\Admin\AppData\Local\Temp\taczgytc.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:4644
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1804

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\mzndobgjz.bo
      Filesize

      185KB

      MD5

      0d1d9c7fd6822452454a7c267358a987

      SHA1

      36e819ed24bd5ade049f02ccaf8445926ac570d6

      SHA256

      081e553634e1e687b29f7a74efed313c167da5483298afe4d306a9dec53383a0

      SHA512

      ae48ce96f9c66c706b19296af75060da88c22a73fd1b5f9545ad11f53c44f1b8d86411052635dd3971c7f5a741a5d9d1d603dbb4431da113cdd384a98d94d2de

    • C:\Users\Admin\AppData\Local\Temp\qudpusdsw.tdv
      Filesize

      5KB

      MD5

      0e2b0c956d02ffa7be574c3e7226dc2d

      SHA1

      6c30eee43b324e421e2e6e24ac666a59120aa682

      SHA256

      f489627db6a48adb35927371e9a6105bc852f7b4dc257876c052bec083c09666

      SHA512

      6587c2466b452b486c4a1de01aa0c516c6c18faee460edddda7e520dcca549a70b5cde6a4eb5c5d535583f05e96b924ef8efd99c8806bcd20286b881154781bd

    • C:\Users\Admin\AppData\Local\Temp\taczgytc.exe
      Filesize

      343KB

      MD5

      3670d0b8a72e51141fe55836d663a1cd

      SHA1

      29f2446d166679a8462bfc91f92af8e49c6d70d2

      SHA256

      e9f11c8aef527b467deef587f26f417e33653c1a48962beef3881ba2054ec23b

      SHA512

      6010e80b94dba3c298e9d528aef2cc4fb199d82f0ec3c5694447c28fe7922977a4c2d72d94a4b401aa5d3bce28026337364d810bc681eb77f8068fc50a6a9fa7

    • C:\Users\Admin\AppData\Local\Temp\taczgytc.exe
      Filesize

      343KB

      MD5

      3670d0b8a72e51141fe55836d663a1cd

      SHA1

      29f2446d166679a8462bfc91f92af8e49c6d70d2

      SHA256

      e9f11c8aef527b467deef587f26f417e33653c1a48962beef3881ba2054ec23b

      SHA512

      6010e80b94dba3c298e9d528aef2cc4fb199d82f0ec3c5694447c28fe7922977a4c2d72d94a4b401aa5d3bce28026337364d810bc681eb77f8068fc50a6a9fa7

    • C:\Users\Admin\AppData\Local\Temp\taczgytc.exe
      Filesize

      343KB

      MD5

      3670d0b8a72e51141fe55836d663a1cd

      SHA1

      29f2446d166679a8462bfc91f92af8e49c6d70d2

      SHA256

      e9f11c8aef527b467deef587f26f417e33653c1a48962beef3881ba2054ec23b

      SHA512

      6010e80b94dba3c298e9d528aef2cc4fb199d82f0ec3c5694447c28fe7922977a4c2d72d94a4b401aa5d3bce28026337364d810bc681eb77f8068fc50a6a9fa7

    • memory/3052-143-0x0000000007EF0000-0x0000000008016000-memory.dmp
      Filesize

      1.1MB

    • memory/3052-154-0x0000000008020000-0x000000000816C000-memory.dmp
      Filesize

      1.3MB

    • memory/3052-152-0x0000000008020000-0x000000000816C000-memory.dmp
      Filesize

      1.3MB

    • memory/3052-150-0x0000000007EF0000-0x0000000008016000-memory.dmp
      Filesize

      1.1MB

    • memory/4592-147-0x0000000000F30000-0x0000000000F3C000-memory.dmp
      Filesize

      48KB

    • memory/4592-148-0x0000000000A00000-0x0000000000A2D000-memory.dmp
      Filesize

      180KB

    • memory/4592-153-0x0000000000A00000-0x0000000000A2D000-memory.dmp
      Filesize

      180KB

    • memory/4592-144-0x0000000000000000-mapping.dmp
    • memory/4592-151-0x0000000002720000-0x00000000027AF000-memory.dmp
      Filesize

      572KB

    • memory/4592-149-0x0000000002970000-0x0000000002CBA000-memory.dmp
      Filesize

      3.3MB

    • memory/4644-145-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4644-146-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/4644-140-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/4644-139-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4644-141-0x0000000001700000-0x0000000001A4A000-memory.dmp
      Filesize

      3.3MB

    • memory/4644-142-0x0000000001150000-0x0000000001160000-memory.dmp
      Filesize

      64KB

    • memory/4644-137-0x0000000000000000-mapping.dmp
    • memory/4652-132-0x0000000000000000-mapping.dmp