Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20-12-2022 23:53

General

  • Target

    payload_formbook.exe

  • Size

    188KB

  • MD5

    96525c4a51a40ab74dcb485b86d72a84

  • SHA1

    c0f5fb91272bcf033156266d447fadb58668fb96

  • SHA256

    9e7423c4b8904ca8dc44c184cd15e755e1e0b554a9182b0e5d4c4e85f341eb84

  • SHA512

    96f142b2eabc5109d87df0b3a6f39a4e735401981d71e471753215b2048924cb9f4f028f3b830de4f5f93d3e4d8711247c1d187f86549e6c3c8c06cfef62b3e3

  • SSDEEP

    3072:y8qzRkfWIYczfzD7nqV+K0fp1TpckexJReVMsYykt9WIFMfWynpXA:yziWIYGzD77jp1FMRKMsCFMrn

Malware Config

Extracted

Family

formbook

Campaign

pgnt

Decoy

0WG18LbM4lR9iqMRa4nlBzTb

jcfGYzPgZTqFZVO9FV2yIw==

laIfrdSC8/4CNg==

Q73ilev5GIWuOrAAFV2yIw==

Q2u/pMw7pv4sPA==

TbqvIUHwlQscPo0HFV2yIw==

8PNWfGPyE8n0IQ==

WtgROxXzvY2L

PryaRBNjm4eP

Y9Hdi06Cry1um9Sj68YAu1o=

3Gulyp7CMQtR78jvLkk=

JJ3GasTVTCRQT6Tfz6S6GlI=

RnS42bhb9tI0R6UpD6wOxriNxw==

he1mi2sOGfzTRGHnuA==

eaYjCtjxVjdU5XLRtBMBLKk9quA=

k9rTeEqYzzw8WaTfz6S6GlI=

5luVQwe2vJWKEAiMdF4=

MGW14L9OVk5Y5TaR6w/DqdhYxXVY

mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==

y5klhuMbE8n0IQ==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Users\Admin\AppData\Local\Temp\payload_formbook.exe
      "C:\Users\Admin\AppData\Local\Temp\payload_formbook.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:1944
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:1160
      • C:\Windows\SysWOW64\NETSTAT.EXE
        "C:\Windows\SysWOW64\NETSTAT.EXE"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Gathers network information
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:1880

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Command-Line Interface

      1
      T1059

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Local\Temp\sqlite3.dll
        Filesize

        904KB

        MD5

        5e5ba61531d74e45b11cadb79e7394a1

        SHA1

        677224e14aac9dd35f367d5eb1704b36e69356b8

        SHA256

        99e91ae250c955bd403ec1a2321d6b11fcb715bdcc7cb3f63ffb46b349afde5c

        SHA512

        712bfe419ba97ecf0ec8323a68743013e8c767da9d986f74ab94d2a395c3086cac2a5823048e0022d3bbcebb55281b9e1f8c87fdc9295c70cc5521b57850bf46

      • memory/1288-63-0x0000000004360000-0x0000000004427000-memory.dmp
        Filesize

        796KB

      • memory/1288-57-0x00000000064D0000-0x000000000662F000-memory.dmp
        Filesize

        1.4MB

      • memory/1288-65-0x0000000004360000-0x0000000004427000-memory.dmp
        Filesize

        796KB

      • memory/1520-58-0x0000000000000000-mapping.dmp
      • memory/1520-60-0x00000000000E0000-0x000000000010D000-memory.dmp
        Filesize

        180KB

      • memory/1520-59-0x0000000000180000-0x0000000000189000-memory.dmp
        Filesize

        36KB

      • memory/1520-61-0x00000000021F0000-0x00000000024F3000-memory.dmp
        Filesize

        3.0MB

      • memory/1520-62-0x0000000001F40000-0x0000000001FCF000-memory.dmp
        Filesize

        572KB

      • memory/1520-64-0x0000000075CF1000-0x0000000075CF3000-memory.dmp
        Filesize

        8KB

      • memory/1944-56-0x0000000000110000-0x0000000000120000-memory.dmp
        Filesize

        64KB

      • memory/1944-54-0x00000000013C0000-0x00000000013EF000-memory.dmp
        Filesize

        188KB

      • memory/1944-55-0x0000000000960000-0x0000000000C63000-memory.dmp
        Filesize

        3.0MB