Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2023, 09:01

General

  • Target

    tmp.exe

  • Size

    255KB

  • MD5

    5cad52271422b36941487ad44a7ade44

  • SHA1

    0fa6ba3c9799301fcdb529abcb5d7098c5c3fdba

  • SHA256

    0cffea5daeb941cc6235f4de2fe2ba348ff08742d196ffc68bc8d7f1109596fd

  • SHA512

    b2a583bff19ace982d3f722c60d5331711a966b000f748e251b83f52eba32185f7469bcc4c0f298d7f0f3876518b0848410667067d2f3187b439a18a6ae192ab

  • SSDEEP

    6144:RC2fT8maVl1F4rxzEc2qauQpeLXsS9ECZXQE3yH:pSv4rxwc2qweLXsSpX3yH

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ms14

Decoy

adjoinstaff.online

kmmdznky.cfd

keyviewgroup.com

kidomarketing.com

jroxtqpq.cfd

jdevmx.com

genqaagz.cfd

1cdpwp.cfd

francegoldvip.com

2qy218.xyz

peterscanner.com

trullys.com

aniwatch.top

windyhillcnc.com

pokazhu.com

r74jsy.cfd

paulgadgets.com

lindanewtee.com

lasik-de-de-8808230.zone

critone.site

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Checks QEMU agent file
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:744
      • C:\Users\Admin\AppData\Local\Temp\tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
        3⤵
        • Checks QEMU agent file
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4204
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1080
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
        3⤵
          PID:5064

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsk7A51.tmp\System.dll

            Filesize

            11KB

            MD5

            375e8a08471dc6f85f3828488b1147b3

            SHA1

            1941484ac710fc301a7d31d6f1345e32a21546af

            SHA256

            4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

            SHA512

            5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

          • memory/744-141-0x0000000077001000-0x0000000077121000-memory.dmp

            Filesize

            1.1MB

          • memory/744-142-0x0000000077001000-0x0000000077121000-memory.dmp

            Filesize

            1.1MB

          • memory/744-143-0x0000000010000000-0x0000000010006000-memory.dmp

            Filesize

            24KB

          • memory/1080-163-0x0000000003080000-0x0000000003113000-memory.dmp

            Filesize

            588KB

          • memory/1080-162-0x00000000011C0000-0x00000000011EE000-memory.dmp

            Filesize

            184KB

          • memory/1080-159-0x0000000003240000-0x000000000358A000-memory.dmp

            Filesize

            3.3MB

          • memory/1080-156-0x00000000011C0000-0x00000000011EE000-memory.dmp

            Filesize

            184KB

          • memory/1080-155-0x0000000000C80000-0x0000000000CA7000-memory.dmp

            Filesize

            156KB

          • memory/1080-154-0x0000000000C80000-0x0000000000CA7000-memory.dmp

            Filesize

            156KB

          • memory/2512-153-0x0000000008DA0000-0x0000000008F0F000-memory.dmp

            Filesize

            1.4MB

          • memory/2512-164-0x0000000008F10000-0x0000000008FEE000-memory.dmp

            Filesize

            888KB

          • memory/2512-167-0x0000000008F10000-0x0000000008FEE000-memory.dmp

            Filesize

            888KB

          • memory/2512-166-0x0000000008F10000-0x0000000008FEE000-memory.dmp

            Filesize

            888KB

          • memory/4204-152-0x0000000001660000-0x0000000006329000-memory.dmp

            Filesize

            76.8MB

          • memory/4204-157-0x0000000077001000-0x0000000077121000-memory.dmp

            Filesize

            1.1MB

          • memory/4204-147-0x0000000000400000-0x0000000001654000-memory.dmp

            Filesize

            18.3MB

          • memory/4204-151-0x0000000036620000-0x0000000036634000-memory.dmp

            Filesize

            80KB

          • memory/4204-146-0x0000000077088000-0x0000000077089000-memory.dmp

            Filesize

            4KB

          • memory/4204-145-0x0000000000400000-0x0000000001654000-memory.dmp

            Filesize

            18.3MB

          • memory/4204-144-0x0000000000400000-0x0000000001654000-memory.dmp

            Filesize

            18.3MB

          • memory/4204-148-0x0000000001660000-0x0000000006329000-memory.dmp

            Filesize

            76.8MB

          • memory/4204-149-0x00000000367A0000-0x0000000036AEA000-memory.dmp

            Filesize

            3.3MB

          • memory/4204-150-0x0000000000400000-0x0000000001654000-memory.dmp

            Filesize

            18.3MB