Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-12-2022 16:56

General

  • Target

    tmp.exe

  • Size

    327KB

  • MD5

    a0f1b339ef38c5d545a7357492b8a327

  • SHA1

    fc4da48839297bac23538e32354b72fc68d464ba

  • SHA256

    469162ec601c979d1e51ad44ea01fa8a4520d650773e7280918128b43691f2e4

  • SHA512

    7143ea53ac918c1affe6bf55f7bd8214e70b02f4bd0bd966eb1ab765822806800ed7d44bdaa49d07c560925393db7aa7fadf954e1381ed201beecfbc85af0a53

  • SSDEEP

    6144:vEb2RYmNJaftegaqDDsjZ5dbr+tzKCc2omW5B8tCaJBg7F/k9:im/aF/54jZb3Ez9crB8Cak7xk9

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sk19

Decoy

21diasdegratitud.com

kx1993.com

chasergt.com

837news.com

naturagent.co.uk

gatorinsurtech.com

iyaboolashilesblog.africa

jamtanganmurah.online

gguminsa.com

lilliesdrop.com

lenvera.com

link48.co.uk

azinos777.fun

lgcdct.cfd

bg-gobtc.com

livecarrer.uk

cbq4u.com

imalreadygone.com

wabeng.africa

jxmheiyouyuetot.tokyo

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4736
      • C:\Users\Admin\AppData\Local\Temp\jpzcdrxg.exe
        "C:\Users\Admin\AppData\Local\Temp\jpzcdrxg.exe" C:\Users\Admin\AppData\Local\Temp\qefijwcnujg.i
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2904
        • C:\Users\Admin\AppData\Local\Temp\jpzcdrxg.exe
          "C:\Users\Admin\AppData\Local\Temp\jpzcdrxg.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:3708
    • C:\Windows\SysWOW64\WWAHost.exe
      "C:\Windows\SysWOW64\WWAHost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\jpzcdrxg.exe"
        3⤵
          PID:228

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\jpzcdrxg.exe

      Filesize

      52KB

      MD5

      455b0b9d1397eab06c4a232fdcc3f813

      SHA1

      e99f02e4cb434600aeaef3999b3dbff174904a09

      SHA256

      81ee7e109870e8c868fdadccd2b40efb1168554e5f71d81a8e5b11cc4da280d8

      SHA512

      1dffb9b043905597d86efd37f5b5d5f919b8fc3c9721e831a4d77b669df38b59711d0dec1d7099d29ee401cb414606d3834083660404320f623817717f83df1c

    • C:\Users\Admin\AppData\Local\Temp\jpzcdrxg.exe

      Filesize

      52KB

      MD5

      455b0b9d1397eab06c4a232fdcc3f813

      SHA1

      e99f02e4cb434600aeaef3999b3dbff174904a09

      SHA256

      81ee7e109870e8c868fdadccd2b40efb1168554e5f71d81a8e5b11cc4da280d8

      SHA512

      1dffb9b043905597d86efd37f5b5d5f919b8fc3c9721e831a4d77b669df38b59711d0dec1d7099d29ee401cb414606d3834083660404320f623817717f83df1c

    • C:\Users\Admin\AppData\Local\Temp\jpzcdrxg.exe

      Filesize

      52KB

      MD5

      455b0b9d1397eab06c4a232fdcc3f813

      SHA1

      e99f02e4cb434600aeaef3999b3dbff174904a09

      SHA256

      81ee7e109870e8c868fdadccd2b40efb1168554e5f71d81a8e5b11cc4da280d8

      SHA512

      1dffb9b043905597d86efd37f5b5d5f919b8fc3c9721e831a4d77b669df38b59711d0dec1d7099d29ee401cb414606d3834083660404320f623817717f83df1c

    • C:\Users\Admin\AppData\Local\Temp\ldonqvgf.ghf

      Filesize

      185KB

      MD5

      8b52a651f744dd3badb5ee90f64b40d4

      SHA1

      80de75313e0b10f0c74b95262d3dafe0596f8765

      SHA256

      f6fe36f391d2781b0a2c2818e479ce9b5e60fc435b3c0044ccb7ef2ce581647a

      SHA512

      dbc7addb1732e5682edea8b5f2d44f70475acd9acf4ce1b7083dee6d854820f9b3d2ddd10594ef5217788317d38c0f642386163607d79732dfc88c3c4ee41b5b

    • C:\Users\Admin\AppData\Local\Temp\qefijwcnujg.i

      Filesize

      5KB

      MD5

      fcb16ae74a574e2f3a5e9dde4f70df6d

      SHA1

      efb566ec323c78d4cd0177bf56e1fbdb4b7912a5

      SHA256

      f75f54e284ea5aef3312148e374818ab364a340e5f5718b8fb4b84824bfe6573

      SHA512

      1cfdd68efb98e2b7f5b0325ee90134ea98e912908a17c824b386f7fbf42d6d9d820a185108b5a573acfdbd82b79c8c96087aa27dae75b183db8ff9c5266fb510

    • memory/228-149-0x0000000000000000-mapping.dmp

    • memory/740-144-0x0000000003010000-0x00000000030E7000-memory.dmp

      Filesize

      860KB

    • memory/740-155-0x0000000008860000-0x0000000008901000-memory.dmp

      Filesize

      644KB

    • memory/740-154-0x0000000008860000-0x0000000008901000-memory.dmp

      Filesize

      644KB

    • memory/740-142-0x00000000086E0000-0x0000000008852000-memory.dmp

      Filesize

      1.4MB

    • memory/740-151-0x0000000003010000-0x00000000030E7000-memory.dmp

      Filesize

      860KB

    • memory/2904-132-0x0000000000000000-mapping.dmp

    • memory/3708-143-0x0000000000950000-0x0000000000964000-memory.dmp

      Filesize

      80KB

    • memory/3708-146-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3708-137-0x0000000000000000-mapping.dmp

    • memory/3708-139-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3708-141-0x00000000008D0000-0x00000000008E4000-memory.dmp

      Filesize

      80KB

    • memory/3708-140-0x0000000000970000-0x0000000000CBA000-memory.dmp

      Filesize

      3.3MB

    • memory/5060-145-0x0000000000000000-mapping.dmp

    • memory/5060-147-0x0000000000270000-0x000000000034C000-memory.dmp

      Filesize

      880KB

    • memory/5060-148-0x0000000000DC0000-0x0000000000DEF000-memory.dmp

      Filesize

      188KB

    • memory/5060-150-0x0000000001C40000-0x0000000001F8A000-memory.dmp

      Filesize

      3.3MB

    • memory/5060-153-0x0000000001B20000-0x0000000001BB3000-memory.dmp

      Filesize

      588KB

    • memory/5060-152-0x0000000000DC0000-0x0000000000DEF000-memory.dmp

      Filesize

      188KB