Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 01:30

General

  • Target

    SecuriteInfo.com.Win32.SuspectCrc.23812.23342.exe

  • Size

    634KB

  • MD5

    b48fbd453403d09c8eaf4b617ebeebcd

  • SHA1

    6567212fac086e07777de8fb30807315fea3aeac

  • SHA256

    4ef967caea627a1b9cd7f74d31584b69d76f8c532cee528e8815c4f70ae24aa7

  • SHA512

    343ea575ceebfb1b7e61ad527902f860c9431c83ed3231112a02495ec83f24215ffdfb4a09f4d2d3ea050bb176e9fc3f37535ba5dd4744ff973bcc529d87216d

  • SSDEEP

    12288:zytjRg5fcPrlI7o1wWGKSoLPS8jY199t9OxOm4pMn:utWcPpI7oOKlLPfY9DwxOvpMn

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

Decoy

slot999.site

hagsahoy.com

howdyart.com

orders-marketplace.com

ranaa.email

masterlink.guru

archershut.com

weikumcommunications.com

dphardmoney.com

shjyutie.com

vivaberlin.net

mycto.today

curvygirlugc.com

otnmp.cfd

alwrists.com

propercandlecompany.com

allindustry-bg.com

theyoungbizacademy.com

expand658170.com

leslainesdumouchon.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Formbook payload 4 IoCs
  • ModiLoader Second Stage 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.SuspectCrc.23812.23342.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.SuspectCrc.23812.23342.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\SysWOW64\colorcpl.exe
        C:\Windows\System32\colorcpl.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4732
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3408
      • C:\Windows\SysWOW64\cmd.exe
        /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
        3⤵
          PID:4212
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:2172

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\DB1

        Filesize

        40KB

        MD5

        b608d407fc15adea97c26936bc6f03f6

        SHA1

        953e7420801c76393902c0d6bb56148947e41571

        SHA256

        b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

        SHA512

        cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

      • C:\Users\Admin\AppData\Roaming\-65A6372\-65logim.jpeg

        Filesize

        77KB

        MD5

        55b7aa8b72400a9cf40caf22af016ac6

        SHA1

        eedd8cca956612d4bbe59333c5d2fa75fd3219f7

        SHA256

        0eca291e42b6b00ff1ec932f5572df46ad40b7be568577890889ed9313e2b3ed

        SHA512

        74ea6e7c65fa7f26e0ff12b821b53bde54c66441bc0853e05661911489ecab0837e1a556176a55644dc2bfa8a7d03d5b258d8d223e852ae42bcbf94e85a15f25

      • C:\Users\Admin\AppData\Roaming\-65A6372\-65logrf.ini

        Filesize

        40B

        MD5

        2f245469795b865bdd1b956c23d7893d

        SHA1

        6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

        SHA256

        1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

        SHA512

        909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

      • C:\Users\Admin\AppData\Roaming\-65A6372\-65logrg.ini

        Filesize

        38B

        MD5

        4aadf49fed30e4c9b3fe4a3dd6445ebe

        SHA1

        1e332822167c6f351b99615eada2c30a538ff037

        SHA256

        75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

        SHA512

        eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

      • C:\Users\Admin\AppData\Roaming\-65A6372\-65logri.ini

        Filesize

        40B

        MD5

        d63a82e5d81e02e399090af26db0b9cb

        SHA1

        91d0014c8f54743bba141fd60c9d963f869d76c9

        SHA256

        eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

        SHA512

        38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

      • C:\Users\Admin\AppData\Roaming\-65A6372\-65logrv.ini

        Filesize

        872B

        MD5

        bbc41c78bae6c71e63cb544a6a284d94

        SHA1

        33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

        SHA256

        ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

        SHA512

        0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

      • memory/2640-146-0x0000000002BF0000-0x0000000002CFC000-memory.dmp

        Filesize

        1.0MB

      • memory/2640-140-0x0000000002BF0000-0x0000000002CFC000-memory.dmp

        Filesize

        1.0MB

      • memory/2640-152-0x0000000008C20000-0x0000000008DAF000-memory.dmp

        Filesize

        1.6MB

      • memory/2640-151-0x0000000008C20000-0x0000000008DAF000-memory.dmp

        Filesize

        1.6MB

      • memory/3408-149-0x0000000001630000-0x00000000016C4000-memory.dmp

        Filesize

        592KB

      • memory/3408-143-0x0000000000760000-0x0000000000777000-memory.dmp

        Filesize

        92KB

      • memory/3408-145-0x0000000001890000-0x0000000001BDA000-memory.dmp

        Filesize

        3.3MB

      • memory/3408-150-0x00000000010E0000-0x000000000110F000-memory.dmp

        Filesize

        188KB

      • memory/3408-144-0x00000000010E0000-0x000000000110F000-memory.dmp

        Filesize

        188KB

      • memory/3408-141-0x0000000000000000-mapping.dmp

      • memory/4212-147-0x0000000000000000-mapping.dmp

      • memory/4500-132-0x00000000007D0000-0x00000000007FB000-memory.dmp

        Filesize

        172KB

      • memory/4500-136-0x0000000010410000-0x000000001043F000-memory.dmp

        Filesize

        188KB

      • memory/4500-135-0x0000000010410000-0x000000001043F000-memory.dmp

        Filesize

        188KB

      • memory/4732-142-0x0000000010410000-0x000000001043F000-memory.dmp

        Filesize

        188KB

      • memory/4732-139-0x0000000005100000-0x0000000005115000-memory.dmp

        Filesize

        84KB

      • memory/4732-138-0x0000000005200000-0x000000000554A000-memory.dmp

        Filesize

        3.3MB

      • memory/4732-134-0x0000000000000000-mapping.dmp