Overview

overview

10

Static

static

1

87901426.exe

windows7-x64

8

87901426.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    323s
  • max time network
    347s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2022 14:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    87901426.exe

  • Size

    602KB

  • MD5

    0597c2f492733078cc3231b33dfc284c

  • SHA1

    c2911934ece108745f314ca7f9e763b7986001a2

  • SHA256

    80a92f2ceb76a9e3f2a5405c1d2d26f838d54b5129d1ce97d60c4af88c07dc61

  • SHA512

    9e99611d0840d297dde4c55ac4146b7728e80e40009e33a88d17dfe6895923047077d991c28fd6371b8372d30e28aa15a83629d85b6566c926c1115c1678b22c

  • SSDEEP

    12288:aLsIqZDM2wnBZ9FxvMMwEYwc4K00PGgmFfdTM2CqvxWm+XZO:agIwY2mZBvT1K0ZgydTlxWm+XA

Score
10/10
formbookyurmpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

yurm

Decoy

X06d1tis1GUX/R0g87Ud

BKiZ33D1P766GVXO1ZwV

lAFdjB7CSxGX8Trz

Gc7dWizTVxWX8Trz

tDkr9JAfi1OHAW1PGOageIp4

bCpMtHKU3mVp8BY5sQ==

7WKpsMWt8nsrhJClJeOZNg==

0A9KTlETQ86Cmd8k0o5NP5RwCg==

aJ61paNJztSp42c=

CrgoA8ySIOsytCbO1ZwV

i46SnHYDD9tTIHI=

XFRCRCjtFZeU3x4Rn3xfD5BnPz+RDA==

c4CZghuHvzW9A31gEz0d

QAjzz9qyRRWBNYseAI4M

Jpbmu4A1YvBvN3ruZgiRmJA5BCFd

PfoFXGNFhhuX8Trz

bqCfk0m8ApAl+Tm1Ms5Tb23IT7tS

z7INff7HNALxc5HWq2/ftrVR6A7R1zvTUQ==

m7IShV4LSFxbqxhrVsZ1Ig==

BHRp7q0gtoRuqBRnVsZ1Ig==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Users\Admin\AppData\Local\Temp\87901426.exe
      "C:\Users\Admin\AppData\Local\Temp\87901426.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Users\Admin\AppData\Local\Temp\xoarypnkl.exe
        "C:\Users\Admin\AppData\Local\Temp\xoarypnkl.exe" "C:\Users\Admin\AppData\Local\Temp\etpdpbvb.au3"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4996
        • C:\Users\Admin\AppData\Local\Temp\xoarypnkl.exe
          "C:\Users\Admin\AppData\Local\Temp\xoarypnkl.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:5068
    • C:\Windows\SysWOW64\help.exe
      "C:\Windows\SysWOW64\help.exe"
      2⤵
        PID:3424

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\etpdpbvb.au3
      Filesize

      7KB

      MD5

      c184ac0072b75419b81858c13e1ac35c

      SHA1

      85bf08dbe9eda5ba3b74183688ca2eeb571ec2e8

      SHA256

      843ec2898e455e722cadb83b5c63c1a6254a1cf8ca0a1092895c40367db9213a

      SHA512

      256e328a297c16c05f96715a09fb27500b0a3bea4061f20c3e11ceb9a7b62bdd5dcba0b2c214cc553549f688c8e71c43bda92befec14f198aa72b9a1aa89f189

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\kvtpbkl.nlk
      Filesize

      185KB

      MD5

      f7ef0d62dc1ca4083eb92b8a56aea0e2

      SHA1

      893bd92f67a1fe403407e638ee3f1d846fc786d5

      SHA256

      f46ffe541737c1b5ef8e532aa5d5b57f27097314a2c633a8b1cf1c8f07a7c506

      SHA512

      d1be464691a80cd8dc7dd5911bd938e70cd2cd1ab9027c9d4141bd861bd8e3dfc96cac2e13ec02d08fb2890434cccf554ac0f0e0ac9ad204889f123899b7eca0

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\rcdjkm.bew
      Filesize

      67KB

      MD5

      0e57730e4ac8cf28b783c382f6b56c28

      SHA1

      d132999d75055e27540ac0e436c24a83bffaabd5

      SHA256

      d0057ecdd92ec284c0dbd72efda0f0455bfae405f7694b6d45554c1cfbb70d2e

      SHA512

      484c152af0b9e3427c3c7f55d08721c4f2f70d9363bd405886cb41552d71cff9888bcbca61d92440c22a53b267d25e94c4efef723846867dded677f7484f1ce3

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\xoarypnkl.exe
      Filesize

      872KB

      MD5

      c56b5f0201a3b3de53e561fe76912bfd

      SHA1

      2a4062e10a5de813f5688221dbeb3f3ff33eb417

      SHA256

      237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

      SHA512

      195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\xoarypnkl.exe
      Filesize

      872KB

      MD5

      c56b5f0201a3b3de53e561fe76912bfd

      SHA1

      2a4062e10a5de813f5688221dbeb3f3ff33eb417

      SHA256

      237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

      SHA512

      195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\xoarypnkl.exe
      Filesize

      872KB

      MD5

      c56b5f0201a3b3de53e561fe76912bfd

      SHA1

      2a4062e10a5de813f5688221dbeb3f3ff33eb417

      SHA256

      237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

      SHA512

      195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

      Download Submit
    • memory/3052-144-0x0000000007C10000-0x0000000007D07000-memory.dmp
      Filesize

      988KB

      Download
    • memory/4996-132-0x0000000000000000-mapping.dmp
      Download
    • memory/5068-138-0x0000000000000000-mapping.dmp
      Download
    • memory/5068-141-0x0000000000401000-0x000000000042F000-memory.dmp
      Filesize

      184KB

      Download
    • memory/5068-142-0x0000000001660000-0x00000000019AA000-memory.dmp
      Filesize

      3.3MB

      Download
    • memory/5068-143-0x00000000007F0000-0x0000000000800000-memory.dmp
      Filesize

      64KB

      Download
    • memory/5068-140-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

      Download