Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06-12-2022 07:38

General

  • Target

    c71e8cd3e58eaeab5de7d296fa62fd6fcad415facc687629d71b25bab56550eb.exe

  • Size

    342KB

  • MD5

    cd0e4cab67b7fd76ef5d6bdcb7f25a21

  • SHA1

    a27ade3067d85e7ed462266b503caed5ef89d3dc

  • SHA256

    c71e8cd3e58eaeab5de7d296fa62fd6fcad415facc687629d71b25bab56550eb

  • SHA512

    c3ae7c68e14ddd2064c926d419ca88531d0344868792b81f8daab42c63aa28a096781fbb0cf38fd367cbf64d94ef073c17d17cef762b5e99bb110ebe00345195

  • SSDEEP

    6144:ZBnbr9ZL8bW6Bg1GzljLDEkYiDifeaOcpTlSxbJ3bzGUAR6ZTu:HfL8bQalnDlRexQxNSlR7

Malware Config

Extracted

Family

formbook

Campaign

f4ca

Decoy

omFHB5ajfJi1UEIEV9XcoRw=

UBjJkmQPyprdhcFF/bdCWQ==

evGKkBUj1je+otcfpw==

KgvGVeOATSt3nug0BIOm2JvOQycB

Lv6o3K0r9aSjI0lr9fg1txw=

LH1jJb/HieQpsEdqWCQTvX2PmsDVIeg=

99dte0XauJfk6Xv+uQxJFgA1gMktBA==

21FkkGB9gMniDQw2ffu6

r4lKBM/q6TZwVZfS

F+14qHeVWi56KdQ=

BgWXRsVoICMvvQ==

I+EozFl0Uy56KdQ=

xoXCgEllKEbWfjFCCLo=

qo9G1lXvvGt5GkxrLQWw

ORNlYic0PJ2ip4geEFSv

Yj+GFpvFxy0uVYx1fLI/XQ==

XL+veIKPjOTe4fjvFs+n

D2JKVAfuakXCAyoEvw==

voWJU81tH56wvt/vImbCcgVd

dVEcwFrmb8bZ4vXvFs+n

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Users\Admin\AppData\Local\Temp\c71e8cd3e58eaeab5de7d296fa62fd6fcad415facc687629d71b25bab56550eb.exe
      "C:\Users\Admin\AppData\Local\Temp\c71e8cd3e58eaeab5de7d296fa62fd6fcad415facc687629d71b25bab56550eb.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4324
      • C:\Users\Admin\AppData\Local\Temp\jrjvptrkw.exe
        "C:\Users\Admin\AppData\Local\Temp\jrjvptrkw.exe" C:\Users\Admin\AppData\Local\Temp\aomgdquqwa.bts
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3976
        • C:\Users\Admin\AppData\Local\Temp\jrjvptrkw.exe
          "C:\Users\Admin\AppData\Local\Temp\jrjvptrkw.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:4888
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\SysWOW64\netsh.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3408
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:4688

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\aomgdquqwa.bts
      Filesize

      5KB

      MD5

      70ac455f88e10ec69807e8d27c5b98a7

      SHA1

      57dbd9bc79b94886f79354ca2025232a5d0076fb

      SHA256

      157b2b1dcb46cfbd5f8ebbcc64bae4fdd45fb9f6843549d5efa39ff294156e68

      SHA512

      4e732530fa2d008d57f86a2f62010d04a67764c230e9f966cf30bdbef2064b0dfc05a983d7919af7db03c690584dd8115ea7dd4b3e34f28cd49cf318dc13b8e1

    • C:\Users\Admin\AppData\Local\Temp\jrjvptrkw.exe
      Filesize

      12KB

      MD5

      fd0ddc905a5457c8fdd921103f410846

      SHA1

      20517958c1cba91084f5011cccf3ece8fdc9a237

      SHA256

      07b65ff3ea050e07441aae8967be4843a74797d004f3aa0b700f5faa59caccec

      SHA512

      2c246fdd4852c364c87ee846682da0b05c419d327456f3ba5e8d00e45f7ac185f00507589219671b82bba4af32369100df577962d0e20f839cfeb8197c7c8c49

    • C:\Users\Admin\AppData\Local\Temp\jrjvptrkw.exe
      Filesize

      12KB

      MD5

      fd0ddc905a5457c8fdd921103f410846

      SHA1

      20517958c1cba91084f5011cccf3ece8fdc9a237

      SHA256

      07b65ff3ea050e07441aae8967be4843a74797d004f3aa0b700f5faa59caccec

      SHA512

      2c246fdd4852c364c87ee846682da0b05c419d327456f3ba5e8d00e45f7ac185f00507589219671b82bba4af32369100df577962d0e20f839cfeb8197c7c8c49

    • C:\Users\Admin\AppData\Local\Temp\jrjvptrkw.exe
      Filesize

      12KB

      MD5

      fd0ddc905a5457c8fdd921103f410846

      SHA1

      20517958c1cba91084f5011cccf3ece8fdc9a237

      SHA256

      07b65ff3ea050e07441aae8967be4843a74797d004f3aa0b700f5faa59caccec

      SHA512

      2c246fdd4852c364c87ee846682da0b05c419d327456f3ba5e8d00e45f7ac185f00507589219671b82bba4af32369100df577962d0e20f839cfeb8197c7c8c49

    • C:\Users\Admin\AppData\Local\Temp\pgcugroogqm.cg
      Filesize

      185KB

      MD5

      e90088efd1be37bc124d82ce812bd327

      SHA1

      633c82a7f3334b6c48a23e96b9ff6116c7cdce27

      SHA256

      09b39f471b88b40e2c29f61d06005b27b799a6d274f0f74262d46d11f9a36d8d

      SHA512

      f93f6119cd5b8c04426b917f6cf6d2f16797970ea4ae00ed0e8014862651ce25a23a5ee60b36aacd37dd7691b3d3bd63c1bdd3a4b0b243456524aff40b7240a4

    • memory/2064-218-0x00000000062D0000-0x0000000006401000-memory.dmp
      Filesize

      1.2MB

    • memory/2064-251-0x0000000000CD0000-0x0000000000DAB000-memory.dmp
      Filesize

      876KB

    • memory/2064-248-0x0000000000CD0000-0x0000000000DAB000-memory.dmp
      Filesize

      876KB

    • memory/3408-239-0x00000000036D0000-0x00000000039F0000-memory.dmp
      Filesize

      3.1MB

    • memory/3408-219-0x0000000000000000-mapping.dmp
    • memory/3408-237-0x0000000001270000-0x000000000128E000-memory.dmp
      Filesize

      120KB

    • memory/3408-238-0x0000000000D60000-0x0000000000D8D000-memory.dmp
      Filesize

      180KB

    • memory/3408-247-0x0000000003390000-0x0000000003521000-memory.dmp
      Filesize

      1.6MB

    • memory/3408-249-0x0000000000D60000-0x0000000000D8D000-memory.dmp
      Filesize

      180KB

    • memory/3408-250-0x0000000003390000-0x0000000003521000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-182-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-159-0x0000000000000000-mapping.dmp
    • memory/3976-179-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-183-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-184-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-181-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-180-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-178-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-177-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-176-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-175-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-174-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-172-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-173-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-170-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-171-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-169-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-168-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-164-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-166-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-165-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-163-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-162-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/3976-161-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-151-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-138-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-157-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-133-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-156-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-155-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-154-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-153-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-152-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-134-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-150-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-149-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-148-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-147-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-146-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-145-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-132-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-144-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-143-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-142-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-141-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-140-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-139-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-158-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-118-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-137-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-136-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-135-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-131-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-130-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-119-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-129-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-120-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-121-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-122-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-123-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-128-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-127-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-124-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-125-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4324-126-0x00000000776D0000-0x000000007785E000-memory.dmp
      Filesize

      1.6MB

    • memory/4888-221-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4888-223-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/4888-217-0x0000000000BD0000-0x0000000000BE0000-memory.dmp
      Filesize

      64KB

    • memory/4888-216-0x0000000001130000-0x0000000001450000-memory.dmp
      Filesize

      3.1MB

    • memory/4888-200-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

    • memory/4888-199-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4888-193-0x00000000004012B0-mapping.dmp