Overview

overview

10

Static

static

Clarice_Q8...22.exe

windows7-x64

10

Clarice_Q8...22.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    226s
  • max time network
    309s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 15:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Clarice_Q88 (Oil-Chemical)_18Nov2022.exe

  • Size

    302KB

  • MD5

    ccfba66eacad3484974046f72f3df72a

  • SHA1

    c1eac06c785fb178a7e7a459a863cc16d9f88e78

  • SHA256

    815e4f0d10bf4c941206a714024bc6c50b84c944cc04baf3e5ae2eab64499e79

  • SHA512

    074f9a149b7efcf08aee62e9c7546c45c0978a28d92195f5eaed1614853667d0b5fff9b9085063a4330eaa167f6bf10f85a87983f8c28a0a7c23ccc163f1653c

  • SSDEEP

    6144:5btXTjHtuamZbBf9ZqOCMzNPNG3S7UFLwSMQNzvA:5BvUDbBXCMhlLUFLwJQm

Score
10/10
formbookermrratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

ermr

Decoy

ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=

qNSdDhu/PT/1fgafDagiCSZH1SY=

wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=

jSxRvptHkeTGl7PT0SEmaZmjqzanuA==

b91oL+2wCcpyhnd6yvF6Pg==

mr81yp1/qqZX

hy7Xsz/PU/LWHMcGL4UYJx9n3A==

KlwrHt1gouPaXaWhoQ==

ng8M320IRJL9Ptw=

8GQbOXuaWxvKnNM=

XndOL7E5sNpVUNty4d/a

rryPBBC8PybYb+2h2MF3FHGL

kEoeyERSVCYO0g==

5/P+SBDby5hO

1fYXc30/h9W7iO17

34X+YKR+wRFE

8ir/X2MlVByh5lQ1ow8=

u9ikm2UMZ7J7hpCYow==

FLI+c3clp1BNDjVAfvC2Dnw=

t21Erq8/r09wAzAJTAH3Ng==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\Clarice_Q88 (Oil-Chemical)_18Nov2022.exe
      "C:\Users\Admin\AppData\Local\Temp\Clarice_Q88 (Oil-Chemical)_18Nov2022.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Users\Admin\AppData\Local\Temp\Clarice_Q88 (Oil-Chemical)_18Nov2022.exe
        "C:\Users\Admin\AppData\Local\Temp\Clarice_Q88 (Oil-Chemical)_18Nov2022.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1176
        • C:\Windows\SysWOW64\wlanext.exe
          "C:\Windows\SysWOW64\wlanext.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1444
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\Clarice_Q88 (Oil-Chemical)_18Nov2022.exe"
            5⤵
            • Deletes itself
            PID:560
    • C:\Windows\SysWOW64\colorcpl.exe
      "C:\Windows\SysWOW64\colorcpl.exe"
      2⤵
        PID:1768

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/560-75-0x0000000000000000-mapping.dmp
      Download
    • memory/1176-61-0x0000000000420330-mapping.dmp
      Download
    • memory/1176-70-0x0000000000400000-0x000000000042D000-memory.dmp
      Filesize

      180KB

      Download
    • memory/1176-68-0x0000000000390000-0x00000000003A1000-memory.dmp
      Filesize

      68KB

      Download
    • memory/1176-58-0x0000000000400000-0x000000000042D000-memory.dmp
      Filesize

      180KB

      Download
    • memory/1176-60-0x0000000000400000-0x000000000042D000-memory.dmp
      Filesize

      180KB

      Download
    • memory/1176-65-0x0000000000230000-0x0000000000241000-memory.dmp
      Filesize

      68KB

      Download
    • memory/1176-63-0x0000000000400000-0x000000000042D000-memory.dmp
      Filesize

      180KB

      Download
    • memory/1176-64-0x00000000008B0000-0x0000000000BB3000-memory.dmp
      Filesize

      3.0MB

      Download
    • memory/1176-57-0x0000000000400000-0x000000000042D000-memory.dmp
      Filesize

      180KB

      Download
    • memory/1248-80-0x0000000006E80000-0x0000000006FFE000-memory.dmp
      Filesize

      1.5MB

      Download
    • memory/1248-71-0x00000000066B0000-0x0000000006805000-memory.dmp
      Filesize

      1.3MB

      Download
    • memory/1248-69-0x00000000062D0000-0x00000000063AA000-memory.dmp
      Filesize

      872KB

      Download
    • memory/1248-78-0x0000000006E80000-0x0000000006FFE000-memory.dmp
      Filesize

      1.5MB

      Download
    • memory/1248-66-0x00000000066B0000-0x0000000006805000-memory.dmp
      Filesize

      1.3MB

      Download
    • memory/1276-55-0x00000000005F0000-0x0000000000622000-memory.dmp
      Filesize

      200KB

      Download
    • memory/1276-56-0x0000000075E81000-0x0000000075E83000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1276-54-0x0000000001170000-0x00000000011C0000-memory.dmp
      Filesize

      320KB

      Download
    • memory/1444-74-0x0000000000080000-0x00000000000AD000-memory.dmp
      Filesize

      180KB

      Download
    • memory/1444-76-0x0000000001EA0000-0x00000000021A3000-memory.dmp
      Filesize

      3.0MB

      Download
    • memory/1444-77-0x0000000001D20000-0x0000000001DB0000-memory.dmp
      Filesize

      576KB

      Download
    • memory/1444-73-0x0000000000510000-0x0000000000526000-memory.dmp
      Filesize

      88KB

      Download
    • memory/1444-79-0x0000000000080000-0x00000000000AD000-memory.dmp
      Filesize

      180KB

      Download
    • memory/1444-72-0x0000000000000000-mapping.dmp
      Download