Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07-02-2023 09:22

General

  • Target

    878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe

  • Size

    52KB

  • MD5

    207fdcecc4c844004d064f7f7d25fb0f

  • SHA1

    4a1b05f7cd8b3ba7c82f48ca8aeb10b264369c4c

  • SHA256

    878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9

  • SHA512

    739ce29e9cf6d5cb25e22841bb28d0e0d825c452df49f3b15e9a0b2d275150f88da198566b540fc3d40c089cbd0dcd077f79620e4a2c2d1f7d9e13a5cb46499d

  • SSDEEP

    768:EyH64NqpyLvO3klekO2Pco2YQ78QTEB6SrZdP545gkRUnqkAmZbI:w5pyLvLy2awvsSVBqukeqxEI

Malware Config

Extracted

Family

formbook

Campaign

scse

Decoy

SKpYFyVNT2zunKf0uuM=

FlEHUseI7I5XbrO8fR/XBcS9ZA==

FPuxoUOxkLiATugw

VKdxsDSk0jdT5Kw=

FpqHf9iI/1tl97E=

YGI6sIl3UIxfZvlD+JiUuuLR

oBAEO0suBEAD5aK00A==

RKJqTzg4gQ/Q6DYSuTjDGkwuyl0ik5Kb8w==

VFg9s3W0/Ype8A3cZb+D7g==

hwD+VNd6014nrsaTWm4FBcS9ZA==

zkAdUq1soKYUfZaTqLmL

XVQ9WbRivUIQ477a/hKv+g==

QireF2geizAwmp674AGc5g==

PSTUQxs6j8OATugw

LHJhyy2VbX8NEqf0uuM=

MiY1vg6T3HqATugw

wqkUjaVXnGgBqA==

jUr/eUtSIT01Wegt

PjQidcqKzAbSZICUZb+D7g==

OkAmcv12sUEAIHwFHakzdIo2FPHw

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Users\Admin\AppData\Local\Temp\878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe
      "C:\Users\Admin\AppData\Local\Temp\878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:880
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
        3⤵
          PID:1116
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
          3⤵
            PID:1992
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
            3⤵
              PID:2020
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
              3⤵
                PID:2024
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
                3⤵
                  PID:1720
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
                  3⤵
                    PID:1716
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
                    3⤵
                      PID:1988
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
                      3⤵
                        PID:1980
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
                        3⤵
                          PID:1144
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
                          3⤵
                            PID:1928
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
                            3⤵
                              PID:1376
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
                              3⤵
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1652
                          • C:\Windows\SysWOW64\cscript.exe
                            "C:\Windows\SysWOW64\cscript.exe"
                            2⤵
                            • Blocklisted process makes network request
                            • Loads dropped DLL
                            • Suspicious use of SetThreadContext
                            • Modifies Internet Explorer settings
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1984
                            • C:\Program Files\Mozilla Firefox\Firefox.exe
                              "C:\Program Files\Mozilla Firefox\Firefox.exe"
                              3⤵
                                PID:1544

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Defense Evasion

                          Modify Registry

                          1
                          T1112

                          Credential Access

                          Credentials in Files

                          1
                          T1081

                          Discovery

                          System Information Discovery

                          1
                          T1082

                          Collection

                          Data from Local System

                          1
                          T1005

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • \Users\Admin\AppData\Local\Temp\sqlite3.dll
                            Filesize

                            804KB

                            MD5

                            b09588d000ef4bf2a3dddd85bd701423

                            SHA1

                            44a810ff8920a340a30b66d932253555143dc28b

                            SHA256

                            ce4ffc1a12150b8523378553f2a97dd3fc44d5210ae6c296ab31e2c78f0d03c3

                            SHA512

                            1d807d92da34ccba4628f2a55c3ac1c03ff63925d79e266b4e52d71002228cbde76206ec696c3e25143fc2e0cab56589155666ff6f8ea0ebfd5ebcd362168e2a

                          • memory/880-55-0x000000001B170000-0x000000001B1E4000-memory.dmp
                            Filesize

                            464KB

                          • memory/880-54-0x0000000001230000-0x0000000001242000-memory.dmp
                            Filesize

                            72KB

                          • memory/1396-65-0x0000000004930000-0x00000000049EA000-memory.dmp
                            Filesize

                            744KB

                          • memory/1396-75-0x0000000007000000-0x00000000070FA000-memory.dmp
                            Filesize

                            1000KB

                          • memory/1396-72-0x0000000004930000-0x00000000049EA000-memory.dmp
                            Filesize

                            744KB

                          • memory/1396-71-0x0000000007000000-0x00000000070FA000-memory.dmp
                            Filesize

                            1000KB

                          • memory/1652-60-0x0000000000400000-0x000000000042E000-memory.dmp
                            Filesize

                            184KB

                          • memory/1652-61-0x0000000000401000-0x000000000042E000-memory.dmp
                            Filesize

                            180KB

                          • memory/1652-64-0x00000000000B0000-0x00000000000C0000-memory.dmp
                            Filesize

                            64KB

                          • memory/1652-62-0x0000000000A00000-0x0000000000D03000-memory.dmp
                            Filesize

                            3.0MB

                          • memory/1652-63-0x0000000000422000-0x0000000000424000-memory.dmp
                            Filesize

                            8KB

                          • memory/1652-56-0x0000000000400000-0x000000000042E000-memory.dmp
                            Filesize

                            184KB

                          • memory/1652-57-0x00000000004012B0-mapping.dmp
                          • memory/1652-59-0x0000000000400000-0x000000000042E000-memory.dmp
                            Filesize

                            184KB

                          • memory/1984-66-0x0000000000000000-mapping.dmp
                          • memory/1984-70-0x00000000009C0000-0x0000000000A4F000-memory.dmp
                            Filesize

                            572KB

                          • memory/1984-69-0x0000000002030000-0x0000000002333000-memory.dmp
                            Filesize

                            3.0MB

                          • memory/1984-73-0x0000000000070000-0x000000000009D000-memory.dmp
                            Filesize

                            180KB

                          • memory/1984-74-0x0000000076871000-0x0000000076873000-memory.dmp
                            Filesize

                            8KB

                          • memory/1984-68-0x0000000000070000-0x000000000009D000-memory.dmp
                            Filesize

                            180KB

                          • memory/1984-67-0x0000000000A70000-0x0000000000A92000-memory.dmp
                            Filesize

                            136KB