Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11-12-2022 23:18

General

  • Target

    Outstanding SOA.exe

  • Size

    339KB

  • MD5

    301addb86ca3c942e69305684bf5c91f

  • SHA1

    5ba7b078b5c4f83582f4b5fab738d2bc40b3caac

  • SHA256

    2c57f3f9227d165321ad3ec29060b58358f3e95968cc1b4b6eff7eb978a993d1

  • SHA512

    119d0d4a47a7dc8a2c6e823a706c5c93c6a3b746d6ac97f4fc1889133b42ac8bb191386bf71c3a299d92b63d87a24031c7a3aa339b7e18f67fe571d723e2dd4b

  • SSDEEP

    6144:9kw5Ozbc0itHVpknYIuGGzQe+rnqLG529GmuVyvp0csCAFSuH:toyBMnYYHHb29BuVyvqh1

Malware Config

Extracted

Family

formbook

Campaign

scse

Decoy

SKpYFyVNT2zunKf0uuM=

FlEHUseI7I5XbrO8fR/XBcS9ZA==

FPuxoUOxkLiATugw

VKdxsDSk0jdT5Kw=

FpqHf9iI/1tl97E=

YGI6sIl3UIxfZvlD+JiUuuLR

oBAEO0suBEAD5aK00A==

RKJqTzg4gQ/Q6DYSuTjDGkwuyl0ik5Kb8w==

VFg9s3W0/Ype8A3cZb+D7g==

hwD+VNd6014nrsaTWm4FBcS9ZA==

zkAdUq1soKYUfZaTqLmL

XVQ9WbRivUIQ477a/hKv+g==

QireF2geizAwmp674AGc5g==

PSTUQxs6j8OATugw

LHJhyy2VbX8NEqf0uuM=

MiY1vg6T3HqATugw

wqkUjaVXnGgBqA==

jUr/eUtSIT01Wegt

PjQidcqKzAbSZICUZb+D7g==

OkAmcv12sUEAIHwFHakzdIo2FPHw

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\Outstanding SOA.exe
      "C:\Users\Admin\AppData\Local\Temp\Outstanding SOA.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exe
        "C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exe" C:\Users\Admin\AppData\Local\Temp\obqdpfez.a
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exe
          "C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1760
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1552
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1916

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    2
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\kzgjp.x
      Filesize

      184KB

      MD5

      8dbfce39af68b4c311134f002508996e

      SHA1

      668460a8bb44136f7d24f570a9adc2bd0d27656b

      SHA256

      fe74da9985715aea87254916677100f703e576b4847654e107944bf732139569

      SHA512

      9f5c438ebaa568387a459c9c8ea59fe02ef5a00bf12bbf07b33cc135517fdfba10b665909787dac80ccfb414a56e2d090a6b6a57a6909d2cd70fa61fc6d06070

    • C:\Users\Admin\AppData\Local\Temp\obqdpfez.a
      Filesize

      7KB

      MD5

      0590f04fc7873d7120ea57b0af0dab5a

      SHA1

      be9ddf0c9f53ff2b88c37edab9ad3dc4634efd7b

      SHA256

      1d7a6baeffe98f729a96e9083cb7791e8117e149562d1e27012b325ba9b925f1

      SHA512

      a869683ca6e435e23571c0fee8a159be75ceeb4a7ccd5ed2af4ecc67e5f74de0ad2a1970d75d7cd0ed64fcb80a66ffc3f40b8dfdfd33d60c6a4055adb8ddf8be

    • C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exe
      Filesize

      287KB

      MD5

      4af2243388a71be98ce2a842a838824f

      SHA1

      69c6f37edad4cbf6fbdfb69065116df7eb6376f5

      SHA256

      2e4ea3195fa6578337b9e2322e22c8066af4a32e18b8c11d69f6c53c084e5f64

      SHA512

      9a9e99f3674f8aba1228f964ba5793e7149b0bf2914404a1f9f9c5e7813b43217b1f90e144596d6da386bfe73a6af2760ab7422392a558daba8f88ae973a8234

    • C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exe
      Filesize

      287KB

      MD5

      4af2243388a71be98ce2a842a838824f

      SHA1

      69c6f37edad4cbf6fbdfb69065116df7eb6376f5

      SHA256

      2e4ea3195fa6578337b9e2322e22c8066af4a32e18b8c11d69f6c53c084e5f64

      SHA512

      9a9e99f3674f8aba1228f964ba5793e7149b0bf2914404a1f9f9c5e7813b43217b1f90e144596d6da386bfe73a6af2760ab7422392a558daba8f88ae973a8234

    • C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exe
      Filesize

      287KB

      MD5

      4af2243388a71be98ce2a842a838824f

      SHA1

      69c6f37edad4cbf6fbdfb69065116df7eb6376f5

      SHA256

      2e4ea3195fa6578337b9e2322e22c8066af4a32e18b8c11d69f6c53c084e5f64

      SHA512

      9a9e99f3674f8aba1228f964ba5793e7149b0bf2914404a1f9f9c5e7813b43217b1f90e144596d6da386bfe73a6af2760ab7422392a558daba8f88ae973a8234

    • \Users\Admin\AppData\Local\Temp\ppazwvktk.exe
      Filesize

      287KB

      MD5

      4af2243388a71be98ce2a842a838824f

      SHA1

      69c6f37edad4cbf6fbdfb69065116df7eb6376f5

      SHA256

      2e4ea3195fa6578337b9e2322e22c8066af4a32e18b8c11d69f6c53c084e5f64

      SHA512

      9a9e99f3674f8aba1228f964ba5793e7149b0bf2914404a1f9f9c5e7813b43217b1f90e144596d6da386bfe73a6af2760ab7422392a558daba8f88ae973a8234

    • \Users\Admin\AppData\Local\Temp\ppazwvktk.exe
      Filesize

      287KB

      MD5

      4af2243388a71be98ce2a842a838824f

      SHA1

      69c6f37edad4cbf6fbdfb69065116df7eb6376f5

      SHA256

      2e4ea3195fa6578337b9e2322e22c8066af4a32e18b8c11d69f6c53c084e5f64

      SHA512

      9a9e99f3674f8aba1228f964ba5793e7149b0bf2914404a1f9f9c5e7813b43217b1f90e144596d6da386bfe73a6af2760ab7422392a558daba8f88ae973a8234

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll
      Filesize

      841KB

      MD5

      5fc6cd5d5ca1489d2a3c361717359a95

      SHA1

      5c630e232cd5761e7a611e41515be4afa3e7a141

      SHA256

      85c8b8a648c56cf5f063912e0e26ecebb90e0caf2f442fd5cdd8287301fe7e81

      SHA512

      5f9124a721f6b463d4f980920e87925098aa753b0fa2a59a3ff48b48d2b1a45d760fd46445414d84fb66321181cd2c82a4194361811114c15e35b42f838ab792

    • memory/1224-70-0x0000000003B70000-0x0000000003C3F000-memory.dmp
      Filesize

      828KB

    • memory/1224-79-0x0000000006270000-0x00000000063CD000-memory.dmp
      Filesize

      1.4MB

    • memory/1224-76-0x0000000006270000-0x00000000063CD000-memory.dmp
      Filesize

      1.4MB

    • memory/1552-72-0x00000000004D0000-0x00000000004E6000-memory.dmp
      Filesize

      88KB

    • memory/1552-73-0x00000000000E0000-0x000000000010D000-memory.dmp
      Filesize

      180KB

    • memory/1552-77-0x00000000000E0000-0x000000000010D000-memory.dmp
      Filesize

      180KB

    • memory/1552-75-0x0000000001CA0000-0x0000000001D2F000-memory.dmp
      Filesize

      572KB

    • memory/1552-74-0x0000000001EE0000-0x00000000021E3000-memory.dmp
      Filesize

      3.0MB

    • memory/1552-71-0x0000000000000000-mapping.dmp
    • memory/1760-65-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/1760-66-0x0000000000401000-0x000000000042E000-memory.dmp
      Filesize

      180KB

    • memory/1760-69-0x0000000000160000-0x0000000000170000-memory.dmp
      Filesize

      64KB

    • memory/1760-67-0x0000000000A00000-0x0000000000D03000-memory.dmp
      Filesize

      3.0MB

    • memory/1760-68-0x0000000000422000-0x0000000000424000-memory.dmp
      Filesize

      8KB

    • memory/1760-63-0x00000000004012B0-mapping.dmp
    • memory/1972-54-0x0000000075501000-0x0000000075503000-memory.dmp
      Filesize

      8KB

    • memory/2036-56-0x0000000000000000-mapping.dmp