Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    25-04-2023 15:14

General

  • Target

    GHXCGHXCGJXC.exe

  • Size

    260KB

  • MD5

    a77431e2d2b1d029280cf0a47b113105

  • SHA1

    f87716cb580a6b5a48a8c3a9112abf070353eaf4

  • SHA256

    1e76071fd87642e4070b75b2f542d65d304dcbb8482e795610bd53b34c54bcb8

  • SHA512

    7c3bb123b65744851b37ec612f9c2541e1e4ee092069b1d9acd14e462251cfe35b471abb3da1c6669c1cfeb3ea677da9e708f1b37728b77e34e8a49b1f2793f8

  • SSDEEP

    6144:sTr7LaS2zIxSM8ZSPSl940ofQoEytRm5Krk6X8Plx:snS5zIxeu0ofOys6X8Plx

Malware Config

Extracted

Family

formbook

Campaign

pgnt

Decoy

0WG18LbM4lR9iqMRa4nlBzTb

jcfGYzPgZTqFZVO9FV2yIw==

laIfrdSC8/4CNg==

Q73ilev5GIWuOrAAFV2yIw==

Q2u/pMw7pv4sPA==

TbqvIUHwlQscPo0HFV2yIw==

8PNWfGPyE8n0IQ==

WtgROxXzvY2L

PryaRBNjm4eP

Y9Hdi06Cry1um9Sj68YAu1o=

3Gulyp7CMQtR78jvLkk=

JJ3GasTVTCRQT6Tfz6S6GlI=

RnS42bhb9tI0R6UpD6wOxriNxw==

he1mi2sOGfzTRGHnuA==

eaYjCtjxVjdU5XLRtBMBLKk9quA=

k9rTeEqYzzw8WaTfz6S6GlI=

5luVQwe2vJWKEAiMdF4=

MGW14L9OVk5Y5TaR6w/DqdhYxXVY

mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==

y5klhuMbE8n0IQ==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\GHXCGHXCGJXC.exe
      "C:\Users\Admin\AppData\Local\Temp\GHXCGHXCGJXC.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"
        3⤵
          PID:2036
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1992
      • C:\Windows\SysWOW64\wininit.exe
        "C:\Windows\SysWOW64\wininit.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:468
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:1596

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\llm8l.zip
        Filesize

        435KB

        MD5

        0d1613320b79de7e8c7627c07d19f4a7

        SHA1

        f85b78ed8568a648b9134beb654e384c622c73bd

        SHA256

        e6fc736d8850729ee5d9d65076e0f4a869530b2c5df7239bda47051fa3c04be7

        SHA512

        13c00d2a48a42c3da05c6f475ab9b0581c951dd62ca0b435c44dbcefdfc02f14597b2b33aa28d3c4c8526adb198b24f1a83d92b12612209ca4aed06b80c7cbfa

      • \Users\Admin\AppData\Local\Temp\sqlite3.dll
        Filesize

        831KB

        MD5

        05ace2f6d9bef6fd9bbd05ee5262a1f2

        SHA1

        5cce2228e0d9c6cc913cf551e0bf7c76ed74ff59

        SHA256

        002459f4d4758011b4d7f36935f1fe323494b847f8c173a551076a3d30475ebc

        SHA512

        1e717a66a72eb626727144fa7458f472ada54fd1be37072c9e740945e34ba94025737aef44e54752c50c5b79a583c6a91a0d8043bf1bf7c3e7cab8537207f9fc

      • memory/468-71-0x0000000000730000-0x000000000074A000-memory.dmp
        Filesize

        104KB

      • memory/468-126-0x0000000061E00000-0x0000000061EBD000-memory.dmp
        Filesize

        756KB

      • memory/468-79-0x0000000001E40000-0x0000000001ECF000-memory.dmp
        Filesize

        572KB

      • memory/468-76-0x0000000001FD0000-0x00000000022D3000-memory.dmp
        Filesize

        3.0MB

      • memory/468-75-0x00000000000D0000-0x00000000000FD000-memory.dmp
        Filesize

        180KB

      • memory/468-74-0x00000000000D0000-0x00000000000FD000-memory.dmp
        Filesize

        180KB

      • memory/468-73-0x0000000000730000-0x000000000074A000-memory.dmp
        Filesize

        104KB

      • memory/1228-70-0x0000000005000000-0x00000000050FA000-memory.dmp
        Filesize

        1000KB

      • memory/1228-64-0x00000000038D0000-0x00000000039D0000-memory.dmp
        Filesize

        1024KB

      • memory/1228-83-0x0000000009530000-0x000000000963C000-memory.dmp
        Filesize

        1.0MB

      • memory/1228-81-0x0000000009530000-0x000000000963C000-memory.dmp
        Filesize

        1.0MB

      • memory/1228-80-0x0000000009530000-0x000000000963C000-memory.dmp
        Filesize

        1.0MB

      • memory/1228-67-0x0000000004C00000-0x0000000004CEF000-memory.dmp
        Filesize

        956KB

      • memory/1712-54-0x000000013FA80000-0x000000013FAC4000-memory.dmp
        Filesize

        272KB

      • memory/1712-56-0x0000000000150000-0x000000000015A000-memory.dmp
        Filesize

        40KB

      • memory/1712-55-0x0000000000140000-0x0000000000146000-memory.dmp
        Filesize

        24KB

      • memory/1992-65-0x00000000008A0000-0x0000000000BA3000-memory.dmp
        Filesize

        3.0MB

      • memory/1992-72-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/1992-62-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/1992-59-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
        Filesize

        4KB

      • memory/1992-60-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/1992-58-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/1992-69-0x00000000001C0000-0x00000000001D0000-memory.dmp
        Filesize

        64KB

      • memory/1992-68-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/1992-66-0x0000000000140000-0x0000000000150000-memory.dmp
        Filesize

        64KB

      • memory/1992-57-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB