Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 06:59

General

  • Target

    697864448562120dd68a9b3a4c36f294292626999e3c80d3217206544e3f91b1.exe

  • Size

    304KB

  • MD5

    60d9730a7f59ab1fd59f0714ef881b06

  • SHA1

    ca8d63135460836a001a38b50c28eae975a2a36c

  • SHA256

    697864448562120dd68a9b3a4c36f294292626999e3c80d3217206544e3f91b1

  • SHA512

    ef6c2bb3fcb705da66416bee8191c9ec7f8992aef9bc5bc108742f15cfc132d2887062e3a85977b0ae005ea8796fb3670517da834534107454957209a851bac4

  • SSDEEP

    6144:U5SuupRIxrjvwT97hu1nbuTnFlzFeVuQqJa64BUR3XR0Ah0eZXBp6bS0fhr8w:UghhwbuTFlzF0uQqCidR0AJrcS0fhr8w

Malware Config

Extracted

Family

formbook

Campaign

pgnt

Decoy

0WG18LbM4lR9iqMRa4nlBzTb

jcfGYzPgZTqFZVO9FV2yIw==

laIfrdSC8/4CNg==

Q73ilev5GIWuOrAAFV2yIw==

Q2u/pMw7pv4sPA==

TbqvIUHwlQscPo0HFV2yIw==

8PNWfGPyE8n0IQ==

WtgROxXzvY2L

PryaRBNjm4eP

Y9Hdi06Cry1um9Sj68YAu1o=

3Gulyp7CMQtR78jvLkk=

JJ3GasTVTCRQT6Tfz6S6GlI=

RnS42bhb9tI0R6UpD6wOxriNxw==

he1mi2sOGfzTRGHnuA==

eaYjCtjxVjdU5XLRtBMBLKk9quA=

k9rTeEqYzzw8WaTfz6S6GlI=

5luVQwe2vJWKEAiMdF4=

MGW14L9OVk5Y5TaR6w/DqdhYxXVY

mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==

y5klhuMbE8n0IQ==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Users\Admin\AppData\Local\Temp\697864448562120dd68a9b3a4c36f294292626999e3c80d3217206544e3f91b1.exe
      "C:\Users\Admin\AppData\Local\Temp\697864448562120dd68a9b3a4c36f294292626999e3c80d3217206544e3f91b1.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
        3⤵
          PID:4528
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:4532
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\SysWOW64\svchost.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:4156

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1040-143-0x0000000007C40000-0x0000000007DA6000-memory.dmp
        Filesize

        1.4MB

      • memory/1040-157-0x00000000033C0000-0x0000000003475000-memory.dmp
        Filesize

        724KB

      • memory/1040-155-0x00000000033C0000-0x0000000003475000-memory.dmp
        Filesize

        724KB

      • memory/1040-147-0x0000000008680000-0x00000000087E4000-memory.dmp
        Filesize

        1.4MB

      • memory/1088-132-0x0000000000E80000-0x0000000000ED2000-memory.dmp
        Filesize

        328KB

      • memory/4528-133-0x0000000000000000-mapping.dmp
      • memory/4532-146-0x0000000001A60000-0x0000000001A70000-memory.dmp
        Filesize

        64KB

      • memory/4532-150-0x0000000000401000-0x000000000042F000-memory.dmp
        Filesize

        184KB

      • memory/4532-141-0x0000000000422000-0x0000000000424000-memory.dmp
        Filesize

        8KB

      • memory/4532-142-0x00000000011B0000-0x00000000011C0000-memory.dmp
        Filesize

        64KB

      • memory/4532-139-0x0000000000401000-0x000000000042F000-memory.dmp
        Filesize

        184KB

      • memory/4532-145-0x0000000000422000-0x0000000000424000-memory.dmp
        Filesize

        8KB

      • memory/4532-138-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/4532-137-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/4532-134-0x0000000000000000-mapping.dmp
      • memory/4532-140-0x0000000001700000-0x0000000001A4A000-memory.dmp
        Filesize

        3.3MB

      • memory/4532-149-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/4532-135-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/4920-152-0x00000000006E0000-0x000000000070D000-memory.dmp
        Filesize

        180KB

      • memory/4920-153-0x0000000001200000-0x000000000154A000-memory.dmp
        Filesize

        3.3MB

      • memory/4920-154-0x0000000001000000-0x000000000108F000-memory.dmp
        Filesize

        572KB

      • memory/4920-151-0x00000000008F0000-0x00000000008FE000-memory.dmp
        Filesize

        56KB

      • memory/4920-156-0x00000000006E0000-0x000000000070D000-memory.dmp
        Filesize

        180KB

      • memory/4920-148-0x0000000000000000-mapping.dmp