Analysis

  • max time kernel
    143s
  • max time network
    131s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/07/2023, 20:08

General

  • Target

    7644456ea433ce8755d64746d7420bcc88df377ac1242657f6428c4a9c51173a.exe

  • Size

    286KB

  • MD5

    db69af7fee69d61e4eb0268afb7cd9f8

  • SHA1

    47568ce8cc356ad3858fc25c334e63d7b8742849

  • SHA256

    7644456ea433ce8755d64746d7420bcc88df377ac1242657f6428c4a9c51173a

  • SHA512

    78e350a54c221b7fabb9780cb6adc70e62a4ef39278a8545795a777a17a84203d2dc689f78531f1118ee6afa875fa52d8fe138cb8b20ac0acfcd28461652b22d

  • SSDEEP

    6144:mz2PI+nT0UvWKIAaMBzLpPCyw7QlBRg5cb3k+mKbG/ICLJqZ:BI4xTIJMxLoNiDkhKdCcZ

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

al05

Decoy

becapmuiu.xyz

wearerp.com

beautychannel.world

kuwiti.com

vex5678.com

pecanbayouwoodworks.com

lrsconcrete.com

emgje.buzz

haorizi.net

tradingbattle.net

growgram.info

zuolide.com

poliedriconsulting.com

persjateng.com

pseudlifelif.com

tgteletg.top

33changing.com

jayagrandcounty.com

thegopigirls.com

c8685.top

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Formbook payload 1 IoCs
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7644456ea433ce8755d64746d7420bcc88df377ac1242657f6428c4a9c51173a.exe
    "C:\Users\Admin\AppData\Local\Temp\7644456ea433ce8755d64746d7420bcc88df377ac1242657f6428c4a9c51173a.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Users\Admin\AppData\Local\Temp\7644456ea433ce8755d64746d7420bcc88df377ac1242657f6428c4a9c51173a.exe
      "C:\Users\Admin\AppData\Local\Temp\7644456ea433ce8755d64746d7420bcc88df377ac1242657f6428c4a9c51173a.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3128

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\nsoA857.tmp\System.dll

          Filesize

          11KB

          MD5

          2ae993a2ffec0c137eb51c8832691bcb

          SHA1

          98e0b37b7c14890f8a599f35678af5e9435906e1

          SHA256

          681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

          SHA512

          2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

        • memory/3128-134-0x0000000001790000-0x0000000005CF0000-memory.dmp

          Filesize

          69.4MB

        • memory/3128-128-0x0000000000400000-0x0000000001783000-memory.dmp

          Filesize

          19.5MB

        • memory/3128-130-0x0000000000400000-0x0000000001783000-memory.dmp

          Filesize

          19.5MB

        • memory/3128-131-0x00007FF9DB070000-0x00007FF9DB24B000-memory.dmp

          Filesize

          1.9MB

        • memory/3128-132-0x0000000077B66000-0x0000000077B67000-memory.dmp

          Filesize

          4KB

        • memory/3128-133-0x0000000000400000-0x0000000001783000-memory.dmp

          Filesize

          19.5MB

        • memory/3128-135-0x0000000036020000-0x0000000036340000-memory.dmp

          Filesize

          3.1MB

        • memory/3128-136-0x0000000001790000-0x0000000005CF0000-memory.dmp

          Filesize

          69.4MB

        • memory/3128-139-0x0000000077AE1000-0x0000000077BF4000-memory.dmp

          Filesize

          1.1MB

        • memory/4956-126-0x0000000077AE1000-0x0000000077BF4000-memory.dmp

          Filesize

          1.1MB

        • memory/4956-127-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB

        • memory/4956-125-0x00007FF9DB070000-0x00007FF9DB24B000-memory.dmp

          Filesize

          1.9MB