Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-12-2022 22:45

General

  • Target

    jeetss456352.exe

  • Size

    214KB

  • MD5

    dafccfe6911e74fd47cf1461e3580ed1

  • SHA1

    b84783ab8d2c044c9a4cf2765831fd776f220c64

  • SHA256

    8d203db46294994fba62e63ddaf99b53c5b8abf2e407f7ee516f5df1d44cc1af

  • SHA512

    4093bbdb3f57b7dff3d6f5e699698c303c9a79cb74bba23778241ea3b8bd12e380ab034065a3f1ff306638346fce69dc8dbc4461983b3cc6c6a95e8a2386c4ab

  • SSDEEP

    3072:qUJoFfWzzl+cSM9BPmuGky8vtGAxeVbzb0kA5nyq956rosqcqXMZdQLfl7Z2JwQo:qweEp9Nmj84AuTqNvGr3qbXrLX2CO4T

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Users\Admin\AppData\Local\Temp\jeetss456352.exe
      "C:\Users\Admin\AppData\Local\Temp\jeetss456352.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3192
      • C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe
        "C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4556
        • C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe
          "C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:364
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Gathers network information
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4912
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe"
        3⤵
          PID:1528

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Command-Line Interface

    1
    T1059

    Discovery

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe
      Filesize

      6KB

      MD5

      4debf3d4be3833c81372eab33bcc8f99

      SHA1

      3c01f72309070804bda00f0545ba92dc32635d36

      SHA256

      a5a20c3c5c6a4882e770da52b1a8d498b39fdbf549bffa6b594566d7f26c99a5

      SHA512

      1418bc4717718a6f2fbbf738cde04509b5a8dcefe430b9be0dde97551248551f136e5d7649d8ef415ce67507cbb2c4c7b3ac29824f6abb611a4f658f46a74451

    • C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe
      Filesize

      6KB

      MD5

      4debf3d4be3833c81372eab33bcc8f99

      SHA1

      3c01f72309070804bda00f0545ba92dc32635d36

      SHA256

      a5a20c3c5c6a4882e770da52b1a8d498b39fdbf549bffa6b594566d7f26c99a5

      SHA512

      1418bc4717718a6f2fbbf738cde04509b5a8dcefe430b9be0dde97551248551f136e5d7649d8ef415ce67507cbb2c4c7b3ac29824f6abb611a4f658f46a74451

    • C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe
      Filesize

      6KB

      MD5

      4debf3d4be3833c81372eab33bcc8f99

      SHA1

      3c01f72309070804bda00f0545ba92dc32635d36

      SHA256

      a5a20c3c5c6a4882e770da52b1a8d498b39fdbf549bffa6b594566d7f26c99a5

      SHA512

      1418bc4717718a6f2fbbf738cde04509b5a8dcefe430b9be0dde97551248551f136e5d7649d8ef415ce67507cbb2c4c7b3ac29824f6abb611a4f658f46a74451

    • C:\Users\Admin\AppData\Local\Temp\lrwrtr.wl
      Filesize

      5KB

      MD5

      b481fd4817e233972e39dd189f695aa6

      SHA1

      33c33dec6a53f11990002b97961c3e513e23a0c1

      SHA256

      c955f7c98bf61071eee2393596ff2e9c3555ba31b353daf5fc438b24fae7ad46

      SHA512

      77eb80bd3f63fd3997b934ff97d81124b778fbf1bc9cf45a664912b1289079c38adea8f7f03a98ecdb2dfc8ec3f347ddf90c8b91abdc6bdcae7a770cb0ec076c

    • C:\Users\Admin\AppData\Local\Temp\ovyicohnryx.es
      Filesize

      185KB

      MD5

      08367820ada06e975ed56b12d436485e

      SHA1

      44508235cd40156d2060bcd53b752e309d5332da

      SHA256

      650167bccb0aab8157bac4ff9553af5b9d75561252c3350eb930fd274f74a935

      SHA512

      0e022b1271ac873b332bf5864664e53e21d592c1c2c949247652d5311e42463a9b03193c3b6948a898bfb42b395ec898b865013322bff58033ff9a67d6a652c0

    • memory/364-144-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/364-137-0x0000000000000000-mapping.dmp
    • memory/364-139-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/364-140-0x00000000009B0000-0x0000000000CFA000-memory.dmp
      Filesize

      3.3MB

    • memory/364-141-0x0000000000D20000-0x0000000000D34000-memory.dmp
      Filesize

      80KB

    • memory/1528-145-0x0000000000000000-mapping.dmp
    • memory/2620-142-0x0000000008290000-0x00000000083DF000-memory.dmp
      Filesize

      1.3MB

    • memory/2620-150-0x0000000007F80000-0x0000000008051000-memory.dmp
      Filesize

      836KB

    • memory/2620-152-0x0000000007F80000-0x0000000008051000-memory.dmp
      Filesize

      836KB

    • memory/4556-132-0x0000000000000000-mapping.dmp
    • memory/4912-143-0x0000000000000000-mapping.dmp
    • memory/4912-146-0x00000000005C0000-0x00000000005CB000-memory.dmp
      Filesize

      44KB

    • memory/4912-147-0x0000000000EF0000-0x0000000000F1F000-memory.dmp
      Filesize

      188KB

    • memory/4912-148-0x0000000001670000-0x00000000019BA000-memory.dmp
      Filesize

      3.3MB

    • memory/4912-149-0x00000000014B0000-0x0000000001543000-memory.dmp
      Filesize

      588KB

    • memory/4912-151-0x0000000000EF0000-0x0000000000F1F000-memory.dmp
      Filesize

      188KB