Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 18:41

General

  • Target

    #PO 4500515595 ULTRA TEC.exe

  • Size

    550KB

  • MD5

    5adbfe3a05eb61b2d2620b6538dc5772

  • SHA1

    8bee7a099e2c1753a62be196915da3756758e75c

  • SHA256

    d404e5865cddbf47f6a494f9120130035b3ac5761810dc75e20bc28873327547

  • SHA512

    5d66a876e199a1733c9c445cdb5d2c4d4842373a710c6a93c088d1d5456ef7c6a3308a56b1b00c5852457ec8db8108b1fe278f45b0dcc7b7433ea20b9e4a465c

  • SSDEEP

    12288:JZ725ZbHWLBajVyuexPgAHsP3o4roF6Btp3P:uCQSxPgAIogPBth

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ey16

Decoy

slimshotonline.com

rifaboa.com

metallzauber.com

jabandfuel.com

reacthat.com

qcgaeu.top

ssongg446.cfd

29kuan7.cfd

101agh.com

reliablii.com

luginfinity.com

e513.cloud

k4lantar.sbs

etoempire.com

phons.info

vovacom.com

birbakalim.fun

wellhousesctx.com

flthg.link

strasburgangus.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\#PO 4500515595 ULTRA TEC.exe
      "C:\Users\Admin\AppData\Local\Temp\#PO 4500515595 ULTRA TEC.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gtpTbwW.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2720
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gtpTbwW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8D0.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2648
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2688
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
            PID:2040
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:2528
        • C:\Windows\SysWOW64\help.exe
          "C:\Windows\SysWOW64\help.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2820
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            3⤵
              PID:1868

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\tmpF8D0.tmp

                Filesize

                1KB

                MD5

                24ea0f7ce8c7b0e4a50b1a106027abe4

                SHA1

                a8567838ecf7544ed3aa332668822ac3b2e553b8

                SHA256

                efe6d31564707d553a06158373e2e00d28b1aa881f2bee59d25d00191afed12f

                SHA512

                895519826b4ac0038b585e71433795c82ef445b5716b9bf45b51f2fd79d929f399cea2553ece4d1c76def02fa5b2186cc7d1f672a4de3cc1069bb84b069f1963

              • memory/1192-43-0x0000000004020000-0x00000000040B9000-memory.dmp

                Filesize

                612KB

              • memory/1192-41-0x0000000004020000-0x00000000040B9000-memory.dmp

                Filesize

                612KB

              • memory/1192-40-0x0000000004020000-0x00000000040B9000-memory.dmp

                Filesize

                612KB

              • memory/1192-31-0x0000000004D40000-0x0000000004E2C000-memory.dmp

                Filesize

                944KB

              • memory/1192-29-0x0000000002E70000-0x0000000002F70000-memory.dmp

                Filesize

                1024KB

              • memory/2528-23-0x0000000000400000-0x000000000042F000-memory.dmp

                Filesize

                188KB

              • memory/2528-20-0x0000000000400000-0x000000000042F000-memory.dmp

                Filesize

                188KB

              • memory/2528-30-0x0000000000190000-0x00000000001A5000-memory.dmp

                Filesize

                84KB

              • memory/2528-28-0x0000000000400000-0x000000000042F000-memory.dmp

                Filesize

                188KB

              • memory/2528-25-0x0000000000980000-0x0000000000C83000-memory.dmp

                Filesize

                3.0MB

              • memory/2528-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

              • memory/2528-18-0x0000000000400000-0x000000000042F000-memory.dmp

                Filesize

                188KB

              • memory/2720-26-0x0000000002680000-0x00000000026C0000-memory.dmp

                Filesize

                256KB

              • memory/2720-15-0x000000006ECB0000-0x000000006F25B000-memory.dmp

                Filesize

                5.7MB

              • memory/2720-17-0x0000000002680000-0x00000000026C0000-memory.dmp

                Filesize

                256KB

              • memory/2720-19-0x0000000002680000-0x00000000026C0000-memory.dmp

                Filesize

                256KB

              • memory/2720-32-0x000000006ECB0000-0x000000006F25B000-memory.dmp

                Filesize

                5.7MB

              • memory/2720-16-0x000000006ECB0000-0x000000006F25B000-memory.dmp

                Filesize

                5.7MB

              • memory/2820-37-0x0000000000080000-0x00000000000AF000-memory.dmp

                Filesize

                188KB

              • memory/2820-33-0x00000000007E0000-0x00000000007E6000-memory.dmp

                Filesize

                24KB

              • memory/2820-39-0x0000000000600000-0x0000000000694000-memory.dmp

                Filesize

                592KB

              • memory/2820-36-0x0000000000980000-0x0000000000C83000-memory.dmp

                Filesize

                3.0MB

              • memory/2820-35-0x0000000000080000-0x00000000000AF000-memory.dmp

                Filesize

                188KB

              • memory/2820-34-0x00000000007E0000-0x00000000007E6000-memory.dmp

                Filesize

                24KB

              • memory/2828-4-0x00000000748E0000-0x0000000074FCE000-memory.dmp

                Filesize

                6.9MB

              • memory/2828-24-0x00000000748E0000-0x0000000074FCE000-memory.dmp

                Filesize

                6.9MB

              • memory/2828-5-0x0000000004C30000-0x0000000004C70000-memory.dmp

                Filesize

                256KB

              • memory/2828-6-0x0000000000660000-0x000000000066C000-memory.dmp

                Filesize

                48KB

              • memory/2828-0-0x00000000748E0000-0x0000000074FCE000-memory.dmp

                Filesize

                6.9MB

              • memory/2828-7-0x0000000004F40000-0x0000000004FAE000-memory.dmp

                Filesize

                440KB

              • memory/2828-3-0x0000000000560000-0x0000000000570000-memory.dmp

                Filesize

                64KB

              • memory/2828-2-0x0000000004C30000-0x0000000004C70000-memory.dmp

                Filesize

                256KB

              • memory/2828-1-0x0000000000350000-0x00000000003DE000-memory.dmp

                Filesize

                568KB