Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2022 10:06

General

  • Target

    Confirmation transfer Ref No_0033463247892.exe

  • Size

    890KB

  • MD5

    03c738a9106a7ba9bad7f4995d52f028

  • SHA1

    204762dbb01579ea39295660d86085591578e0a1

  • SHA256

    aa6874a63646474141e2928b094c5dc15a1fc2ea610ece7ca7f95b80ec856be5

  • SHA512

    d87e427aa177cd28b989e00a4bb382679054009a55021834319ee78bcc181b91d72b639c78fceb7e89584aef552af2fbb7cd90ec76719fb8cc81b18acf4e8c8d

  • SSDEEP

    24576:jmRx3Gdhk0yClxNwArBMQm8i9eXiDdEPf:jmr32hkGFxBlmFezP

Malware Config

Extracted

Family

formbook

Campaign

q4k5

Decoy

ZXN4RZ1db9JIzC7mhQ==

5+KpXZWys/DewpGQbChh6uPT5SNzFQ==

A8YuEKESXrzBhw==

uYH/9+Amwe1ZMkaR

KAusoWlA4I1Rt0P0jA==

AgIBy9IHiq8cdo4h47hB

PsX/0DrQRr+0hQ==

3z4v9UwXBjNTf48h47hB

bySPUkT+SFuT

VsQK5NkDks06l5z+TUG3eetd/twx2Mcjlg==

3+DcnQWuXG84sOphj5LEHIv/hA==

TOZXSDkjSHDoLk/pl2HYpOXJ

q7GGZ9KJrss/oTNwyxI=

2+O/k7y22Qo=

Joatk/qnSoO3q48h47hB

KT1UQcQ9yxWFQzCI

onRBEIHmYIl9XzhAIMtPLFAh5SNzFQ==

a8IY/+/oCDOj2TuM4Ohc

UlIOzyniF1sRnTNwyxI=

8UJiR6gijbvt+exXo7oCvdNV4BE=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_0033463247892.exe
      "C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_0033463247892.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eSdygJSxTrIOo.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1472
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eSdygJSxTrIOo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp97BC.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:4016
      • C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_0033463247892.exe
        "C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_0033463247892.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3992
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:4384
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:5040
        • C:\Windows\SysWOW64\autoconv.exe
          "C:\Windows\SysWOW64\autoconv.exe"
          2⤵
            PID:548
          • C:\Windows\SysWOW64\cscript.exe
            "C:\Windows\SysWOW64\cscript.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1988
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:2080

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmp97BC.tmp

            Filesize

            1KB

            MD5

            1616c5e0c10bd23fc5b71cec56c2aa2f

            SHA1

            ddeb525b95bc172a289e7ecc180ed26dd92b26ce

            SHA256

            1646226d26026aae9cced10302b8b0f9abad039bff923d9cdf738759c295c1cf

            SHA512

            5a36dc8af00d52e1ad5a3c8bdc62afc88d5554970c342e3fded97794fd3de3e3a0ac2de26c6cbbb31ea6e8ec3b965233523d11ffe7c12d20162969784968f43c

          • memory/1472-145-0x0000000005BB0000-0x0000000005BD2000-memory.dmp

            Filesize

            136KB

          • memory/1472-157-0x0000000071A70000-0x0000000071ABC000-memory.dmp

            Filesize

            304KB

          • memory/1472-142-0x0000000005550000-0x0000000005B78000-memory.dmp

            Filesize

            6.2MB

          • memory/1472-170-0x0000000007A70000-0x0000000007A8A000-memory.dmp

            Filesize

            104KB

          • memory/1472-137-0x0000000000000000-mapping.dmp

          • memory/1472-169-0x0000000007960000-0x000000000796E000-memory.dmp

            Filesize

            56KB

          • memory/1472-139-0x0000000002B00000-0x0000000002B36000-memory.dmp

            Filesize

            216KB

          • memory/1472-158-0x00000000069D0000-0x00000000069EE000-memory.dmp

            Filesize

            120KB

          • memory/1472-156-0x00000000069F0000-0x0000000006A22000-memory.dmp

            Filesize

            200KB

          • memory/1472-146-0x0000000005D70000-0x0000000005DD6000-memory.dmp

            Filesize

            408KB

          • memory/1472-171-0x0000000007A50000-0x0000000007A58000-memory.dmp

            Filesize

            32KB

          • memory/1472-159-0x0000000007D70000-0x00000000083EA000-memory.dmp

            Filesize

            6.5MB

          • memory/1472-160-0x0000000007730000-0x000000000774A000-memory.dmp

            Filesize

            104KB

          • memory/1472-147-0x0000000005DE0000-0x0000000005E46000-memory.dmp

            Filesize

            408KB

          • memory/1472-161-0x00000000077A0000-0x00000000077AA000-memory.dmp

            Filesize

            40KB

          • memory/1472-165-0x00000000079B0000-0x0000000007A46000-memory.dmp

            Filesize

            600KB

          • memory/1472-150-0x0000000006410000-0x000000000642E000-memory.dmp

            Filesize

            120KB

          • memory/1988-162-0x0000000000000000-mapping.dmp

          • memory/1988-166-0x00000000008C0000-0x00000000008E7000-memory.dmp

            Filesize

            156KB

          • memory/1988-167-0x0000000002E90000-0x00000000031DA000-memory.dmp

            Filesize

            3.3MB

          • memory/1988-172-0x0000000002DB0000-0x0000000002E3F000-memory.dmp

            Filesize

            572KB

          • memory/1988-168-0x0000000000E30000-0x0000000000E5D000-memory.dmp

            Filesize

            180KB

          • memory/1988-174-0x0000000000E30000-0x0000000000E5D000-memory.dmp

            Filesize

            180KB

          • memory/3024-182-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-189-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-199-0x0000000007920000-0x0000000007930000-memory.dmp

            Filesize

            64KB

          • memory/3024-198-0x0000000007920000-0x0000000007930000-memory.dmp

            Filesize

            64KB

          • memory/3024-197-0x0000000007920000-0x0000000007930000-memory.dmp

            Filesize

            64KB

          • memory/3024-196-0x0000000003120000-0x00000000031FC000-memory.dmp

            Filesize

            880KB

          • memory/3024-195-0x0000000007920000-0x0000000007930000-memory.dmp

            Filesize

            64KB

          • memory/3024-194-0x0000000007920000-0x0000000007930000-memory.dmp

            Filesize

            64KB

          • memory/3024-193-0x0000000007920000-0x0000000007930000-memory.dmp

            Filesize

            64KB

          • memory/3024-192-0x0000000003220000-0x0000000003230000-memory.dmp

            Filesize

            64KB

          • memory/3024-191-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-190-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-155-0x0000000008820000-0x00000000089CB000-memory.dmp

            Filesize

            1.7MB

          • memory/3024-188-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-187-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-173-0x0000000003120000-0x00000000031FC000-memory.dmp

            Filesize

            880KB

          • memory/3024-186-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-175-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-176-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-177-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-178-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-179-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-180-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-181-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-185-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-183-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3024-184-0x0000000003210000-0x0000000003220000-memory.dmp

            Filesize

            64KB

          • memory/3992-149-0x0000000000401000-0x000000000042F000-memory.dmp

            Filesize

            184KB

          • memory/3992-164-0x0000000000401000-0x000000000042F000-memory.dmp

            Filesize

            184KB

          • memory/3992-154-0x0000000000FF0000-0x0000000001000000-memory.dmp

            Filesize

            64KB

          • memory/3992-153-0x0000000000422000-0x0000000000424000-memory.dmp

            Filesize

            8KB

          • memory/3992-152-0x0000000001960000-0x0000000001CAA000-memory.dmp

            Filesize

            3.3MB

          • memory/3992-163-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/3992-143-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/3992-148-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/3992-141-0x0000000000000000-mapping.dmp

          • memory/4016-138-0x0000000000000000-mapping.dmp

          • memory/4812-132-0x0000000000270000-0x0000000000354000-memory.dmp

            Filesize

            912KB

          • memory/4812-133-0x00000000051A0000-0x0000000005744000-memory.dmp

            Filesize

            5.6MB

          • memory/4812-136-0x00000000078E0000-0x000000000797C000-memory.dmp

            Filesize

            624KB

          • memory/4812-135-0x0000000004D90000-0x0000000004D9A000-memory.dmp

            Filesize

            40KB

          • memory/4812-134-0x0000000004CE0000-0x0000000004D72000-memory.dmp

            Filesize

            584KB