Overview

overview

10

Static

static

PRODUCTS L...RY.exe

windows7-x64

10

PRODUCTS L...RY.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    185s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-12-2022 13:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PRODUCTS LIST INQUIRY.exe

  • Size

    833KB

  • MD5

    62dbf29de2b765943525b45e080c168a

  • SHA1

    cd40c7a3ae6d2c6e2c7436eb5da2407d84f6cc7b

  • SHA256

    52b739a0edc9a1a008131eedb6b9385e6aa99ea46e15ab65fa7e1045ec6908e2

  • SHA512

    4059ebb5665670ba140a14aad5996407fe843bb19491b9f10a00e423c5e1332a8a325dd8fa4e438418d5ef1a451d749b19506c18cae4218161b140346d780a54

  • SSDEEP

    12288:IckyiUw4N8guVN4P9OCEqrK40DafmmiVR2mqrYy6FjmaZgKZ/nXt7virmWhlGLak:bkyiN4GPVN4P9OFqu40DRRmY

Score
10/10
formbook0vh9ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

0vh9

Decoy

kT0Usm0+fHGF7CkiArMh/tpf8d/XmQE=

0fmX7QILD44W+4BvafbZzOs=

cu0K8dW1ampaxA==

mMUbaeih2AfncJFGQQ==

hbUGHyjFfvGHWhfdzKFAKACZFug=

yjwyDLSAuuQScZpTEt/p0g==

QVOuL9rCqaSZBDn18NM=

80J9zt627lL0

dRXhSLjVSYyE2g==

QuSd7Qu7JmkOkqOTf9gC4P5d322R+Ak=

TGmyjSzk7VR50A==

Per96I1KSYyE2g==

smg9xW2N/NH8O5xPQw==

epfEwPC7ggR37cX39cc=

s2tPNeqhoGyRpCQevaVh

0HJrO9mYxtjW0m+nEfbZzOs=

9ppmyuPh6JiKX+17X/bZzOs=

wrxE0u6FSNp5RtFYT83Yj+s2sz4kyg==

y4FnMsyMjUo7DqoovqLXyw==

tWNC35fFQyZe1Mt7fAQyHuycNOs=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe
      "C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe
        "C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe"
        3⤵
          PID:2708
        • C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe
          "C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe"
          3⤵
            PID:3476
          • C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe
            "C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe"
            3⤵
              PID:1668
            • C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe
              "C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST INQUIRY.exe"
              3⤵
              • Checks computer location settings
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:3828
          • C:\Windows\SysWOW64\colorcpl.exe
            "C:\Windows\SysWOW64\colorcpl.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:4924

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1668-139-0x0000000000000000-mapping.dmp
          Download
        • memory/2024-132-0x0000000000A70000-0x0000000000B46000-memory.dmp
          Filesize

          856KB

          Download
        • memory/2024-133-0x00000000059E0000-0x0000000005F84000-memory.dmp
          Filesize

          5.6MB

          Download
        • memory/2024-134-0x0000000005430000-0x00000000054C2000-memory.dmp
          Filesize

          584KB

          Download
        • memory/2024-135-0x0000000005390000-0x000000000539A000-memory.dmp
          Filesize

          40KB

          Download
        • memory/2024-136-0x0000000007750000-0x00000000077EC000-memory.dmp
          Filesize

          624KB

          Download
        • memory/2644-158-0x00000000033A0000-0x00000000034B0000-memory.dmp
          Filesize

          1.1MB

          Download
        • memory/2644-155-0x0000000008660000-0x00000000087A5000-memory.dmp
          Filesize

          1.3MB

          Download
        • memory/2644-148-0x0000000008660000-0x00000000087A5000-memory.dmp
          Filesize

          1.3MB

          Download
        • memory/2708-137-0x0000000000000000-mapping.dmp
          Download
        • memory/3476-138-0x0000000000000000-mapping.dmp
          Download
        • memory/3828-145-0x00000000015D0000-0x000000000191A000-memory.dmp
          Filesize

          3.3MB

          Download
        • memory/3828-141-0x0000000000400000-0x000000000042F000-memory.dmp
          Filesize

          188KB

          Download
        • memory/3828-147-0x0000000001070000-0x0000000001080000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3828-143-0x0000000000400000-0x000000000042F000-memory.dmp
          Filesize

          188KB

          Download
        • memory/3828-149-0x0000000000400000-0x000000000042F000-memory.dmp
          Filesize

          188KB

          Download
        • memory/3828-150-0x0000000000401000-0x000000000042F000-memory.dmp
          Filesize

          184KB

          Download
        • memory/3828-140-0x0000000000000000-mapping.dmp
          Download
        • memory/3828-144-0x0000000000401000-0x000000000042F000-memory.dmp
          Filesize

          184KB

          Download
        • memory/4924-153-0x0000000000C80000-0x0000000000CAD000-memory.dmp
          Filesize

          180KB

          Download
        • memory/4924-154-0x0000000002C00000-0x0000000002F4A000-memory.dmp
          Filesize

          3.3MB

          Download
        • memory/4924-152-0x0000000000650000-0x0000000000669000-memory.dmp
          Filesize

          100KB

          Download
        • memory/4924-156-0x0000000000C80000-0x0000000000CAD000-memory.dmp
          Filesize

          180KB

          Download
        • memory/4924-157-0x0000000002B30000-0x0000000002BBF000-memory.dmp
          Filesize

          572KB

          Download
        • memory/4924-151-0x0000000000000000-mapping.dmp
          Download