Overview

overview

10

Static

static

lib64.exe

windows7-x64

10

lib64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-12-2022 05:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    lib64.exe

  • Size

    202KB

  • MD5

    676380743dd23f61e18c1e044105168a

  • SHA1

    387fbee19170c2ddc8c4faa2b38131fe9b3259de

  • SHA256

    d8b2ccbb31253f78340e5a95ac72cb871e52338526817cc5db09107becaf7b36

  • SHA512

    685d3bf901993ddec9a786132f1f9e9b48c6d8697fdce67f26813b0e1d1b1b2419d37db35c43829578255b51d80877a243b395d2a4423eef4174b5168dfc8b14

  • SSDEEP

    6144:qxAVDI/PTDCC4vX7NYEpItOeDwh0UkezRpt:qxAVD6Pn0v+EaOeDo0yzRT

Score
10/10
formbooks3f0ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

s3f0

Decoy

zm/xqaOkp7SIM6I9k8cYYQ==

R3BJUiYhIJsD50TcNbbEexs=

r92WbDh7DjlsCftKuG56

UmoUBecGa6YL6A==

UQLQ4AmN+i0R

ATNkzEHBHyMM

BSHJi2n11k/Oq+6Mug==

+Z7elo1OY5UH6Q==

dZEf25y+5WLNqDGY9DI=

Zu6ipAkOo1QGo6fHrw==

iquKhUajLOlfLDduk8cYYQ==

6HcbD4jxPzcS

kCkEGSRmmQVzS1l7k8cYYQ==

kpV9fdfeZ3ZO/ozTsg==

Vea2yr7h+HTYxwHH9C8=

j7h4fHeMuGfayAHH9C8=

tcQ2/YKFQAFqYKxQfu09Rjl6FA==

RVYC2MYEERU2x8sXLiY=

dv+nDEaN+i0R

CbNkLJj8EFE0Hmn/LSeqpVhnTmJs

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\lib64.exe
      "C:\Users\Admin\AppData\Local\Temp\lib64.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:1152
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:1816
      • C:\Windows\SysWOW64\WWAHost.exe
        "C:\Windows\SysWOW64\WWAHost.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1964
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:776

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1152-133-0x0000000000510000-0x000000000053F000-memory.dmp
        Filesize

        188KB

        Download
      • memory/1152-134-0x00000000018C0000-0x0000000001C0A000-memory.dmp
        Filesize

        3.3MB

        Download
      • memory/1152-135-0x0000000000510000-0x000000000053F000-memory.dmp
        Filesize

        188KB

        Download
      • memory/1152-136-0x0000000001320000-0x0000000001330000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1964-140-0x0000000000E80000-0x0000000000EAD000-memory.dmp
        Filesize

        180KB

        Download
      • memory/1964-138-0x0000000000000000-mapping.dmp
        Download
      • memory/1964-139-0x00000000005F0000-0x00000000006CC000-memory.dmp
        Filesize

        880KB

        Download
      • memory/1964-141-0x0000000001B80000-0x0000000001ECA000-memory.dmp
        Filesize

        3.3MB

        Download
      • memory/1964-142-0x00000000019B0000-0x0000000001A3F000-memory.dmp
        Filesize

        572KB

        Download
      • memory/1964-144-0x0000000000E80000-0x0000000000EAD000-memory.dmp
        Filesize

        180KB

        Download
      • memory/2016-137-0x0000000002790000-0x00000000028F3000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/2016-143-0x0000000002C00000-0x0000000002CE7000-memory.dmp
        Filesize

        924KB

        Download
      • memory/2016-145-0x0000000002C00000-0x0000000002CE7000-memory.dmp
        Filesize

        924KB

        Download