Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 08:25

General

  • Target

    DHL Express Duty Charge, AWB & BL.exe

  • Size

    580KB

  • MD5

    53f6cb13cf941ca18bc398d32f845579

  • SHA1

    a09d0166e26b59e01d8f9314c98534adcb6de340

  • SHA256

    12748aea84778652c1b2fef43117bdb42de3061f4a4376927ca27154cce42013

  • SHA512

    c272cc3432ad0ed6946fb6c95a9e76842f605b66096bfc86203245176e460494ed670f718110468c9c71957dcd29d66006b7738e40e951cb06f9c762234c2494

  • SSDEEP

    12288:isDRL2aOfokSwTh/TCu3SCfn1YD9wj0lmbPOFh7HuTO:DJOfo9+8VCfn89QPOB

Malware Config

Extracted

Family

formbook

Campaign

h8t0

Decoy

pX0T7fJ5SmBsroaYtF/qyNlKtSA=

S2NpcYsZ0sMKKsWw

InTDrCxX1GVhp7fzmK8=

mH5Ax6r2GyAh

GYKFkKD2GyAh

TyWptjZgzlzNV0Y2PtM85dlKtSA=

D/V0extZ3I/PVr6mCqGNazBB

xik8B2uLuILxdg==

oohXUF/7tHGxQs42SvIo+64=

7W/2B7CoqOEfY3WqCw==

SKW3c0DvmA991EE=

dx1jYxAG+T9YaOxctM5OqQ==

uBwqzYUt3KHNKEI1Oq/2tV4UUQ==

HkhDv2iluILxdg==

O8ca/3Z0p/xD0dc9jwgr2g6oorw/DA==

CdVTZwxFv2LSRyckeO1Uvg==

UaO+if0kiQ0HHe29lwaEIv+morw/DA==

wB5RfRm6wFunIVY=

UvpBQ+Ucf97/PRGJm4v8

s86lipNDSIu9D/IqkUIhHGUMTA==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Users\Admin\AppData\Local\Temp\DHL Express Duty Charge, AWB & BL.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL Express Duty Charge, AWB & BL.exe"
      2⤵
      • Checks QEMU agent file
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3076
      • C:\Users\Admin\AppData\Local\Temp\DHL Express Duty Charge, AWB & BL.exe
        "C:\Users\Admin\AppData\Local\Temp\DHL Express Duty Charge, AWB & BL.exe"
        3⤵
        • Checks QEMU agent file
        • Checks computer location settings
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4868
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\SysWOW64\mstsc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:4508

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsm99C6.tmp\System.dll

    Filesize

    11KB

    MD5

    6f5257c0b8c0ef4d440f4f4fce85fb1b

    SHA1

    b6ac111dfb0d1fc75ad09c56bde7830232395785

    SHA256

    b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

    SHA512

    a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

  • memory/3076-149-0x0000000002A10000-0x0000000002AEB000-memory.dmp

    Filesize

    876KB

  • memory/3076-136-0x0000000002A10000-0x0000000002AEB000-memory.dmp

    Filesize

    876KB

  • memory/3076-137-0x0000000002A10000-0x0000000002AEB000-memory.dmp

    Filesize

    876KB

  • memory/3076-138-0x00007FF810950000-0x00007FF810B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3076-139-0x0000000077900000-0x0000000077AA3000-memory.dmp

    Filesize

    1.6MB

  • memory/3076-142-0x0000000077900000-0x0000000077AA3000-memory.dmp

    Filesize

    1.6MB

  • memory/3080-167-0x0000000008D00000-0x0000000008E05000-memory.dmp

    Filesize

    1.0MB

  • memory/3080-155-0x0000000008BA0000-0x0000000008CFD000-memory.dmp

    Filesize

    1.4MB

  • memory/3080-165-0x0000000008BA0000-0x0000000008CFD000-memory.dmp

    Filesize

    1.4MB

  • memory/3080-169-0x0000000008D00000-0x0000000008E05000-memory.dmp

    Filesize

    1.0MB

  • memory/4508-166-0x0000000002560000-0x00000000025EF000-memory.dmp

    Filesize

    572KB

  • memory/4508-164-0x0000000002630000-0x000000000297A000-memory.dmp

    Filesize

    3.3MB

  • memory/4508-163-0x00000000003B0000-0x00000000003DD000-memory.dmp

    Filesize

    180KB

  • memory/4508-162-0x0000000000840000-0x000000000097A000-memory.dmp

    Filesize

    1.2MB

  • memory/4508-168-0x00000000003B0000-0x00000000003DD000-memory.dmp

    Filesize

    180KB

  • memory/4508-157-0x0000000000000000-mapping.dmp

  • memory/4868-151-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/4868-161-0x0000000077900000-0x0000000077AA3000-memory.dmp

    Filesize

    1.6MB

  • memory/4868-154-0x000000001D820000-0x000000001DB6A000-memory.dmp

    Filesize

    3.3MB

  • memory/4868-152-0x0000000000401000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/4868-156-0x000000001D640000-0x000000001D650000-memory.dmp

    Filesize

    64KB

  • memory/4868-150-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/4868-158-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/4868-159-0x0000000001660000-0x0000000001760000-memory.dmp

    Filesize

    1024KB

  • memory/4868-160-0x00007FF810950000-0x00007FF810B45000-memory.dmp

    Filesize

    2.0MB

  • memory/4868-153-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/4868-148-0x0000000077900000-0x0000000077AA3000-memory.dmp

    Filesize

    1.6MB

  • memory/4868-147-0x00007FF810950000-0x00007FF810B45000-memory.dmp

    Filesize

    2.0MB

  • memory/4868-146-0x0000000077900000-0x0000000077AA3000-memory.dmp

    Filesize

    1.6MB

  • memory/4868-145-0x00007FF810950000-0x00007FF810B45000-memory.dmp

    Filesize

    2.0MB

  • memory/4868-144-0x0000000001660000-0x0000000001760000-memory.dmp

    Filesize

    1024KB

  • memory/4868-143-0x0000000001660000-0x0000000001760000-memory.dmp

    Filesize

    1024KB

  • memory/4868-141-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/4868-140-0x0000000000000000-mapping.dmp