Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-06-2023 13:02

General

  • Target

    tmp.exe

  • Size

    371KB

  • MD5

    bb82589608f2312e9bf9d0c63c8a3d68

  • SHA1

    c66d15184ef9a38a7423f1a6fbc60c94132051f9

  • SHA256

    3682f76c6feec004f58d0b9c732b45215375d45f250bdac03fb3694097710c3f

  • SHA512

    c839f9653e021cd06deaa1b529506596598473f8e62347a5a01e88a09fdf6316a17e5cad8502646fc40db955505c44082ba5ed1e62bd2ce8e8bf8daa1dcecb3a

  • SSDEEP

    6144:A6dANzV+OT7ck3Ke1/Lhw5ewNi4F/oJrcy+ShsV6+gn:iP+OTQkFLhaez4FSVsVI

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xchu

Decoy

zcartoons.com

castilloshowroom.com

3bmmdtod.life

misaxoxo.com

nadiya.online

sykkbup29.xyz

triciaaprimrosevp.com

newleter.com

ptzslk.xyz

lightbulbfestival.com

texaslandline.com

ideeintemporelle.com

girljustdoitpodcast.com

medimediamarketing.com

bunk7outfitters.com

charlievgrfminnick.click

lifestyleinthehome.com

atfbestsale.online

frontdoorproperties.co.uk

grandpaswag2024.info

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Formbook payload 5 IoCs
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:804
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Checks QEMU agent file
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Users\Admin\AppData\Local\Temp\tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
        3⤵
        • Checks QEMU agent file
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:5096
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:2004
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\SysWOW64\netsh.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1296
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
          3⤵
            PID:2300

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsu6D85.tmp\System.dll
        Filesize

        11KB

        MD5

        0063d48afe5a0cdc02833145667b6641

        SHA1

        e7eb614805d183ecb1127c62decb1a6be1b4f7a8

        SHA256

        ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

        SHA512

        71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

      • memory/804-167-0x00000000086E0000-0x0000000008847000-memory.dmp
        Filesize

        1.4MB

      • memory/804-160-0x0000000007F70000-0x00000000080EB000-memory.dmp
        Filesize

        1.5MB

      • memory/804-152-0x0000000008450000-0x0000000008567000-memory.dmp
        Filesize

        1.1MB

      • memory/804-165-0x00000000086E0000-0x0000000008847000-memory.dmp
        Filesize

        1.4MB

      • memory/804-164-0x00000000086E0000-0x0000000008847000-memory.dmp
        Filesize

        1.4MB

      • memory/804-149-0x0000000007F70000-0x00000000080EB000-memory.dmp
        Filesize

        1.5MB

      • memory/1296-161-0x00000000005A0000-0x00000000005CF000-memory.dmp
        Filesize

        188KB

      • memory/1296-163-0x0000000000FF0000-0x0000000001083000-memory.dmp
        Filesize

        588KB

      • memory/1296-159-0x00000000005A0000-0x00000000005CF000-memory.dmp
        Filesize

        188KB

      • memory/1296-158-0x00000000011A0000-0x00000000014EA000-memory.dmp
        Filesize

        3.3MB

      • memory/1296-156-0x0000000000FD0000-0x0000000000FEE000-memory.dmp
        Filesize

        120KB

      • memory/1296-153-0x0000000000FD0000-0x0000000000FEE000-memory.dmp
        Filesize

        120KB

      • memory/3928-141-0x0000000003230000-0x000000000644F000-memory.dmp
        Filesize

        50.1MB

      • memory/3928-140-0x0000000003230000-0x000000000644F000-memory.dmp
        Filesize

        50.1MB

      • memory/5096-145-0x0000000000400000-0x0000000001654000-memory.dmp
        Filesize

        18.3MB

      • memory/5096-155-0x0000000001660000-0x000000000487F000-memory.dmp
        Filesize

        50.1MB

      • memory/5096-157-0x0000000000400000-0x0000000001654000-memory.dmp
        Filesize

        18.3MB

      • memory/5096-151-0x0000000000110000-0x0000000000124000-memory.dmp
        Filesize

        80KB

      • memory/5096-150-0x0000000000400000-0x0000000001654000-memory.dmp
        Filesize

        18.3MB

      • memory/5096-147-0x0000000034C40000-0x0000000034F8A000-memory.dmp
        Filesize

        3.3MB

      • memory/5096-148-0x00000000000D0000-0x00000000000E4000-memory.dmp
        Filesize

        80KB

      • memory/5096-146-0x0000000001660000-0x000000000487F000-memory.dmp
        Filesize

        50.1MB

      • memory/5096-144-0x0000000001660000-0x000000000487F000-memory.dmp
        Filesize

        50.1MB

      • memory/5096-143-0x0000000001660000-0x000000000487F000-memory.dmp
        Filesize

        50.1MB

      • memory/5096-142-0x0000000000400000-0x0000000001654000-memory.dmp
        Filesize

        18.3MB