Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    17-07-2024 09:25

General

  • Target

    nell.rtf

  • Size

    513KB

  • MD5

    fb3027e4c7adc0370181f6f73c6dff33

  • SHA1

    9ded925615bd1ef1c5dd88febdd10b1bb29b83df

  • SHA256

    da7597eed278b6ebb330685e1caea6c1bc6ad9b2abff9afa05633f4cb5f7a123

  • SHA512

    70325e60251e76ef02a505d77fd2f01fbe1a67796dd2187a24533200dbdf80d4b5e352b0dc87a7c714f78edc776bac10f8625d66126e261bf69cf5eb0d8bdad4

  • SSDEEP

    6144:W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W62W626:ZP

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

btrd

Decoy

everslane.com

prairieviewelectric.online

dszvhgd.com

papamuch.com

8129k.vip

jeffreestar.gold

bestguestrentals.com

nvzhuang1.net

anangtoto.com

yxfgor.top

practicalpoppers.com

thebestanglephotography.online

koormm.top

criika.net

audioflow.online

380747.net

jiuguanwang.net

bloxequities.com

v321c.com

sugar.monster

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1388
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\nell.rtf"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1216
      • C:\Windows\SysWOW64\autofmt.exe
        "C:\Windows\SysWOW64\autofmt.exe"
        2⤵
          PID:2668
        • C:\Windows\SysWOW64\autofmt.exe
          "C:\Windows\SysWOW64\autofmt.exe"
          2⤵
            PID:2148
          • C:\Windows\SysWOW64\autofmt.exe
            "C:\Windows\SysWOW64\autofmt.exe"
            2⤵
              PID:2240
            • C:\Windows\SysWOW64\autofmt.exe
              "C:\Windows\SysWOW64\autofmt.exe"
              2⤵
                PID:2864
              • C:\Windows\SysWOW64\autofmt.exe
                "C:\Windows\SysWOW64\autofmt.exe"
                2⤵
                  PID:2184
                • C:\Windows\SysWOW64\autofmt.exe
                  "C:\Windows\SysWOW64\autofmt.exe"
                  2⤵
                    PID:2360
                  • C:\Windows\SysWOW64\autofmt.exe
                    "C:\Windows\SysWOW64\autofmt.exe"
                    2⤵
                      PID:1896
                    • C:\Windows\SysWOW64\autofmt.exe
                      "C:\Windows\SysWOW64\autofmt.exe"
                      2⤵
                        PID:580
                      • C:\Windows\SysWOW64\autofmt.exe
                        "C:\Windows\SysWOW64\autofmt.exe"
                        2⤵
                          PID:2580
                        • C:\Windows\SysWOW64\autofmt.exe
                          "C:\Windows\SysWOW64\autofmt.exe"
                          2⤵
                            PID:2692
                          • C:\Windows\SysWOW64\autofmt.exe
                            "C:\Windows\SysWOW64\autofmt.exe"
                            2⤵
                              PID:2928
                            • C:\Windows\SysWOW64\autofmt.exe
                              "C:\Windows\SysWOW64\autofmt.exe"
                              2⤵
                                PID:2064
                              • C:\Windows\SysWOW64\autofmt.exe
                                "C:\Windows\SysWOW64\autofmt.exe"
                                2⤵
                                  PID:2932
                                • C:\Windows\SysWOW64\autofmt.exe
                                  "C:\Windows\SysWOW64\autofmt.exe"
                                  2⤵
                                    PID:3040
                                  • C:\Windows\SysWOW64\autofmt.exe
                                    "C:\Windows\SysWOW64\autofmt.exe"
                                    2⤵
                                      PID:1192
                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                                    1⤵
                                    • Blocklisted process makes network request
                                    • Loads dropped DLL
                                    • Launches Equation Editor
                                    • Suspicious use of WriteProcessMemory
                                    PID:1648
                                    • C:\Users\Admin\AppData\Roaming\nell56789.scr
                                      "C:\Users\Admin\AppData\Roaming\nell56789.scr"
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of WriteProcessMemory
                                      PID:2984
                                      • C:\Users\Admin\AppData\Roaming\nell56789.scr
                                        "C:\Users\Admin\AppData\Roaming\nell56789.scr"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:2704
                                        • C:\Windows\SysWOW64\wininit.exe
                                          "C:\Windows\SysWOW64\wininit.exe"
                                          4⤵
                                          • Suspicious use of SetThreadContext
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious behavior: MapViewOfSection
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:748
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /c del "C:\Users\Admin\AppData\Roaming\nell56789.scr"
                                            5⤵
                                              PID:2332

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

                                      Filesize

                                      19KB

                                      MD5

                                      de3031d0e18ddfb08b5ed543fbf5e138

                                      SHA1

                                      f245502af4efe21e20db08bc3b0cd9e603e38a8d

                                      SHA256

                                      1c4b548960023f29693ef3b72779365f82bd94cc09100548a174183e4642649d

                                      SHA512

                                      83f2c137bcd3e05e5bb08aa18e65c491f264bf2def9875486b0cfae6c07ae02fd500e830400eaf32cce6034738165fdcc18dfd73ad0f173d7077d9d2c5630223

                                    • \Users\Admin\AppData\Roaming\nell56789.scr

                                      Filesize

                                      617KB

                                      MD5

                                      bbb12cd2696ac986ad79c0116da987f4

                                      SHA1

                                      802f65e20825ee6b2b5074e6084bc284241278d8

                                      SHA256

                                      d8e6a83561b9d8dbe84de21795763589d2626904ac6406ddfe2dc2342c4edb8e

                                      SHA512

                                      318e885d898a42b2751d387ba48b6fb359d3665d18637de48f35a53ea525bccbd1d9175a1f0429051d0a714ee887900ad3577db36d31d65f89ba7fb185484911

                                    • memory/748-42-0x00000000005B0000-0x00000000005CA000-memory.dmp

                                      Filesize

                                      104KB

                                    • memory/748-43-0x00000000000C0000-0x00000000000EF000-memory.dmp

                                      Filesize

                                      188KB

                                    • memory/1388-48-0x0000000006B00000-0x0000000006C50000-memory.dmp

                                      Filesize

                                      1.3MB

                                    • memory/1388-45-0x00000000051F0000-0x00000000052F8000-memory.dmp

                                      Filesize

                                      1.0MB

                                    • memory/1712-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/1712-2-0x000000007108D000-0x0000000071098000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/1712-75-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/1712-44-0x000000007108D000-0x0000000071098000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/1712-0-0x000000002F581000-0x000000002F582000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2704-33-0x0000000000080000-0x00000000000AF000-memory.dmp

                                      Filesize

                                      188KB

                                    • memory/2704-41-0x0000000000080000-0x00000000000AF000-memory.dmp

                                      Filesize

                                      188KB

                                    • memory/2704-31-0x0000000000080000-0x00000000000AF000-memory.dmp

                                      Filesize

                                      188KB

                                    • memory/2704-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2704-38-0x0000000000080000-0x00000000000AF000-memory.dmp

                                      Filesize

                                      188KB

                                    • memory/2984-30-0x0000000000660000-0x0000000000668000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/2984-29-0x0000000002130000-0x0000000002192000-memory.dmp

                                      Filesize

                                      392KB

                                    • memory/2984-28-0x0000000000100000-0x00000000001A0000-memory.dmp

                                      Filesize

                                      640KB

                                    • memory/2984-27-0x000000006B23E000-0x000000006B23F000-memory.dmp

                                      Filesize

                                      4KB