Analysis

  • max time kernel
    145s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    17-07-2024 16:35

General

  • Target

    ESW2091H52Y6.vbe

  • Size

    4.7MB

  • MD5

    6d933e921beffff0992ccdb64bbfa968

  • SHA1

    24149345e79200dc21fb6d853e62d7e9ceaf605c

  • SHA256

    1d204cb5dccb45236e756ff1d5e1605ab30b67948a40af27c195b6d4f2e5a2ae

  • SHA512

    9b8ea5fe63f9e3ae856bdf437bb18f94d923d2674f6d085d65a8d3cf95b58ff10fee530e7ed290fd87995e3c4ea7562334e7c9f2d48736410bd20f168272d4b4

  • SSDEEP

    12288:sk+zeB3lLnyTHm63p8P+RQf77puZL0Sfr3ucJ6q53mxmaQEd1wZ4mjBRclC:skbhAFDu7pjSfaI52xmX4mjBRB

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

de94

Decoy

way2future.net

worldnewsdailys.online

rendamaisbr.com

s485.icu

vcxwpo.xyz

imagivilleartists.com

herbatyorganics.com

xn--80ado1abokv5d.xn--p1acf

invigoratewell.com

especialistaleitura.online

pkrstg.com

performacaretechnical.com

dreamgame55.net

hkitgugx.xyz

istanlikbilgiler.click

slotter99j.vip

exploringtheoutdoors.net

triberoots.com

energiaslotsbet.com

dkforcm.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Adds policy Run key to start application 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: MapViewOfSection 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ESW2091H52Y6.vbe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Users\Admin\AppData\Local\Temp\HHhHh.exe
        "C:\Users\Admin\AppData\Local\Temp\HHhHh.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1268
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
          4⤵
            PID:2756
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
            4⤵
              PID:2776
            • C:\Windows\System32\calc.exe
              "C:\Windows\System32\calc.exe"
              4⤵
                PID:2888
              • C:\Windows\System32\notepad.exe
                "C:\Windows\System32\notepad.exe"
                4⤵
                  PID:2916
                • C:\Program Files (x86)\Windows Mail\wab.exe
                  "C:\Program Files (x86)\Windows Mail\wab.exe"
                  4⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2992
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 1268 -s 656
                  4⤵
                  • Loads dropped DLL
                  PID:2828
            • C:\Windows\SysWOW64\help.exe
              "C:\Windows\SysWOW64\help.exe"
              2⤵
              • Adds policy Run key to start application
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • Modifies Internet Explorer settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2908
              • C:\Program Files\Mozilla Firefox\Firefox.exe
                "C:\Program Files\Mozilla Firefox\Firefox.exe"
                3⤵
                  PID:1664

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\KNPQ4AV3\KNPlogim.jpeg

              Filesize

              94KB

              MD5

              f096e655ee6ea3e468e5204124bc6d25

              SHA1

              32c4264d12f227f7b3919975f1ca740ce9e1d60d

              SHA256

              024ae9be86ccc0e05cddeb5b6ac956dd99507d662862397c1b7dbaa5b77bfe61

              SHA512

              37bcee3e64ab741724d734657649dff1e09ae75de245295ae2c5208673381d594e32fb11388487acc1dd103d9af69172c6906564c64f2ed17bc2f0899cc60b92

            • C:\Users\Admin\AppData\Roaming\KNPQ4AV3\KNPlogrf.ini

              Filesize

              40B

              MD5

              2f245469795b865bdd1b956c23d7893d

              SHA1

              6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

              SHA256

              1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

              SHA512

              909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

            • C:\Users\Admin\AppData\Roaming\KNPQ4AV3\KNPlogri.ini

              Filesize

              40B

              MD5

              d63a82e5d81e02e399090af26db0b9cb

              SHA1

              91d0014c8f54743bba141fd60c9d963f869d76c9

              SHA256

              eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

              SHA512

              38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

            • C:\Users\Admin\AppData\Roaming\KNPQ4AV3\KNPlogrv.ini

              Filesize

              40B

              MD5

              ba3b6bc807d4f76794c4b81b09bb9ba5

              SHA1

              24cb89501f0212ff3095ecc0aba97dd563718fb1

              SHA256

              6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507

              SHA512

              ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf

            • \Users\Admin\AppData\Local\Temp\HHhHh.exe

              Filesize

              3.3MB

              MD5

              2e2001da412256e70357a85c584a5b61

              SHA1

              6d35c2d73b30d6fe0c428687210d591856243006

              SHA256

              bad6f8d92ae8b460fa4cba747f45ca96d2292579375a5973a709b03a2e192aa3

              SHA512

              1eef20ee569e98bd5d4f797489745713ab4b8b7c8a97f4367dd13d892afce0e1a5f72c51c6fa82f1fa3a30a1e95b1be03162a9f1ea3ba025356a18619e450d41

            • memory/1196-34-0x0000000006AB0000-0x0000000006BEB000-memory.dmp

              Filesize

              1.2MB

            • memory/1196-54-0x000000000A100000-0x000000000A27B000-memory.dmp

              Filesize

              1.5MB

            • memory/1196-51-0x0000000007880000-0x0000000007A01000-memory.dmp

              Filesize

              1.5MB

            • memory/1196-40-0x0000000007880000-0x0000000007A01000-memory.dmp

              Filesize

              1.5MB

            • memory/1196-37-0x0000000006AB0000-0x0000000006BEB000-memory.dmp

              Filesize

              1.2MB

            • memory/1268-44-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

              Filesize

              9.9MB

            • memory/1268-43-0x000007FEF5643000-0x000007FEF5644000-memory.dmp

              Filesize

              4KB

            • memory/1268-66-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

              Filesize

              9.9MB

            • memory/1268-7-0x000007FEF5643000-0x000007FEF5644000-memory.dmp

              Filesize

              4KB

            • memory/1268-8-0x0000000001080000-0x000000000108C000-memory.dmp

              Filesize

              48KB

            • memory/1268-9-0x000000001B040000-0x000000001B04C000-memory.dmp

              Filesize

              48KB

            • memory/1268-10-0x0000000000BD0000-0x0000000000C58000-memory.dmp

              Filesize

              544KB

            • memory/1268-11-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

              Filesize

              9.9MB

            • memory/2888-12-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2888-14-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2908-41-0x00000000004B0000-0x00000000004B6000-memory.dmp

              Filesize

              24KB

            • memory/2908-45-0x0000000000080000-0x00000000000AF000-memory.dmp

              Filesize

              188KB

            • memory/2908-42-0x00000000004B0000-0x00000000004B6000-memory.dmp

              Filesize

              24KB

            • memory/2992-33-0x0000000000190000-0x00000000001A4000-memory.dmp

              Filesize

              80KB

            • memory/2992-38-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2992-39-0x00000000001D0000-0x00000000001E4000-memory.dmp

              Filesize

              80KB

            • memory/2992-25-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/2992-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2992-30-0x00000000008D0000-0x0000000000BD3000-memory.dmp

              Filesize

              3.0MB

            • memory/2992-32-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB