Analysis

  • max time kernel
    166s
  • max time network
    194s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 09:23

General

  • Target

    Quotation Request - 10001.exe

  • Size

    974KB

  • MD5

    8adef204222f1f04ca7cab99cc19acd0

  • SHA1

    ca9f9f95b42dd59cb9f6025b2b2bca16519fc00f

  • SHA256

    90212e18e6b4b235bbb6f4083bd0a2c491e0be12edc600199eb0ed0839d9a554

  • SHA512

    413e126fd5598dc1cba282595cad155d841d8222f861e264a857ef956f1d8f3deb63ae92be12737de3e3b89a5c51cbefa544500885127a3429bd7714ec6a89d5

  • SSDEEP

    24576:sp3ym7jOPcdHAcWohx6n53nD29Zgu/P2Up+L74mBfNUstzo:sp3fHOPHohxC3nD6Zgu/uU

Malware Config

Extracted

Family

formbook

Campaign

m5oe

Decoy

HdR8hG6r12hBYuHY4zv6YeeFPQ==

tD1V9gswYvgQXEGd

1xKtJ1LdqRYMRMC84U1A

MbhjiWb7Lz8z7KIWl3UyUIJwA6Tb

joVB5Xggy2RtE+odsZg=

TrduAIay6Y3SvoIK20xI

pSna7LOsXXwXT/zz3Iow4g==

QnthmO4Qst5gC3sDoA==

eAirzOOgO7SOCenz3Iow4g==

xg0uSbfLTg==

YWQXwyGRzPEHzGrDFE8CBSE=

ujLnfuXoH9dbgHIK20xI

291v0XsGFrYQXEGd

MRvTd/qMuaHpjCM=

X131fLC6VWX4MsvCb2IPjIfq8wlksWfg

Y9Bur8DbgqFt/Yni86MMCCE=

q6RTBmJkmy5pWTmmCCrvmuCDPw==

mQS26DojT+EQXEGd

sjHQ+Kav2Wx9FeodsZg=

JA24UKnTA5re1LhcQaVo/w==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Users\Admin\AppData\Local\Temp\Quotation Request - 10001.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation Request - 10001.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Users\Admin\AppData\Local\Temp\Quotation Request - 10001.exe
        "C:\Users\Admin\AppData\Local\Temp\Quotation Request - 10001.exe"
        3⤵
          PID:2484
        • C:\Users\Admin\AppData\Local\Temp\Quotation Request - 10001.exe
          "C:\Users\Admin\AppData\Local\Temp\Quotation Request - 10001.exe"
          3⤵
            PID:1420
          • C:\Users\Admin\AppData\Local\Temp\Quotation Request - 10001.exe
            "C:\Users\Admin\AppData\Local\Temp\Quotation Request - 10001.exe"
            3⤵
            • Checks computer location settings
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:4364
        • C:\Windows\SysWOW64\WWAHost.exe
          "C:\Windows\SysWOW64\WWAHost.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1196

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/964-147-0x0000000008DB0000-0x0000000008F58000-memory.dmp
        Filesize

        1.7MB

      • memory/964-155-0x0000000008F60000-0x0000000009078000-memory.dmp
        Filesize

        1.1MB

      • memory/964-154-0x0000000008F60000-0x0000000009078000-memory.dmp
        Filesize

        1.1MB

      • memory/1196-153-0x0000000000E30000-0x0000000000E5D000-memory.dmp
        Filesize

        180KB

      • memory/1196-149-0x0000000000890000-0x000000000096C000-memory.dmp
        Filesize

        880KB

      • memory/1196-148-0x0000000000000000-mapping.dmp
      • memory/1196-151-0x0000000001BB0000-0x0000000001EFA000-memory.dmp
        Filesize

        3.3MB

      • memory/1196-150-0x0000000000E30000-0x0000000000E5D000-memory.dmp
        Filesize

        180KB

      • memory/1196-152-0x0000000001AE0000-0x0000000001B6F000-memory.dmp
        Filesize

        572KB

      • memory/1312-135-0x0000000005010000-0x000000000501A000-memory.dmp
        Filesize

        40KB

      • memory/1312-132-0x00000000004D0000-0x00000000005CA000-memory.dmp
        Filesize

        1000KB

      • memory/1312-136-0x0000000006F60000-0x0000000006FFC000-memory.dmp
        Filesize

        624KB

      • memory/1312-134-0x0000000004F70000-0x0000000005002000-memory.dmp
        Filesize

        584KB

      • memory/1312-133-0x0000000005480000-0x0000000005A24000-memory.dmp
        Filesize

        5.6MB

      • memory/1420-138-0x0000000000000000-mapping.dmp
      • memory/2484-137-0x0000000000000000-mapping.dmp
      • memory/4364-146-0x0000000000CD0000-0x0000000000CE0000-memory.dmp
        Filesize

        64KB

      • memory/4364-145-0x0000000001140000-0x000000000148A000-memory.dmp
        Filesize

        3.3MB

      • memory/4364-144-0x0000000000401000-0x000000000042F000-memory.dmp
        Filesize

        184KB

      • memory/4364-143-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/4364-142-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/4364-140-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/4364-139-0x0000000000000000-mapping.dmp