Analysis

  • max time kernel
    146s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-07-2024 16:35

General

  • Target

    ESW2091H52Y6.vbe

  • Size

    4.7MB

  • MD5

    6d933e921beffff0992ccdb64bbfa968

  • SHA1

    24149345e79200dc21fb6d853e62d7e9ceaf605c

  • SHA256

    1d204cb5dccb45236e756ff1d5e1605ab30b67948a40af27c195b6d4f2e5a2ae

  • SHA512

    9b8ea5fe63f9e3ae856bdf437bb18f94d923d2674f6d085d65a8d3cf95b58ff10fee530e7ed290fd87995e3c4ea7562334e7c9f2d48736410bd20f168272d4b4

  • SSDEEP

    12288:sk+zeB3lLnyTHm63p8P+RQf77puZL0Sfr3ucJ6q53mxmaQEd1wZ4mjBRclC:skbhAFDu7pjSfaI52xmX4mjBRB

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

de94

Decoy

way2future.net

worldnewsdailys.online

rendamaisbr.com

s485.icu

vcxwpo.xyz

imagivilleartists.com

herbatyorganics.com

xn--80ado1abokv5d.xn--p1acf

invigoratewell.com

especialistaleitura.online

pkrstg.com

performacaretechnical.com

dreamgame55.net

hkitgugx.xyz

istanlikbilgiler.click

slotter99j.vip

exploringtheoutdoors.net

triberoots.com

energiaslotsbet.com

dkforcm.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ESW2091H52Y6.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3720
      • C:\Users\Admin\AppData\Local\Temp\HHhHh.exe
        "C:\Users\Admin\AppData\Local\Temp\HHhHh.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4612
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
          4⤵
            PID:3948
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
            4⤵
              PID:2284
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe"
              4⤵
              • Runs regedit.exe
              PID:864
            • C:\Windows\System32\svchost.exe
              "C:\Windows\System32\svchost.exe"
              4⤵
                PID:2156
              • C:\Windows\System32\calc.exe
                "C:\Windows\System32\calc.exe"
                4⤵
                  PID:968
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                  4⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4536
            • C:\Windows\SysWOW64\msiexec.exe
              "C:\Windows\SysWOW64\msiexec.exe"
              2⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4928
              • C:\Windows\SysWOW64\cmd.exe
                /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                3⤵
                  PID:1464

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\HHhHh.exe

              Filesize

              3.3MB

              MD5

              2e2001da412256e70357a85c584a5b61

              SHA1

              6d35c2d73b30d6fe0c428687210d591856243006

              SHA256

              bad6f8d92ae8b460fa4cba747f45ca96d2292579375a5973a709b03a2e192aa3

              SHA512

              1eef20ee569e98bd5d4f797489745713ab4b8b7c8a97f4367dd13d892afce0e1a5f72c51c6fa82f1fa3a30a1e95b1be03162a9f1ea3ba025356a18619e450d41

            • memory/3528-36-0x0000000008F00000-0x0000000008FD1000-memory.dmp

              Filesize

              836KB

            • memory/3528-35-0x0000000008D80000-0x0000000008EFC000-memory.dmp

              Filesize

              1.5MB

            • memory/3528-26-0x0000000008D80000-0x0000000008EFC000-memory.dmp

              Filesize

              1.5MB

            • memory/3528-21-0x0000000008840000-0x00000000089EC000-memory.dmp

              Filesize

              1.7MB

            • memory/4536-24-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/4536-25-0x0000000001790000-0x00000000017A4000-memory.dmp

              Filesize

              80KB

            • memory/4536-16-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/4536-17-0x0000000001C80000-0x0000000001FCA000-memory.dmp

              Filesize

              3.3MB

            • memory/4536-20-0x00000000016D0000-0x00000000016E4000-memory.dmp

              Filesize

              80KB

            • memory/4536-19-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/4612-15-0x00007FFE28B00000-0x00007FFE295C1000-memory.dmp

              Filesize

              10.8MB

            • memory/4612-22-0x00007FFE28B00000-0x00007FFE295C1000-memory.dmp

              Filesize

              10.8MB

            • memory/4612-13-0x000002C0DDE50000-0x000002C0DDE5C000-memory.dmp

              Filesize

              48KB

            • memory/4612-14-0x000002C0C55C0000-0x000002C0C5648000-memory.dmp

              Filesize

              544KB

            • memory/4612-12-0x000002C0C3960000-0x000002C0C396C000-memory.dmp

              Filesize

              48KB

            • memory/4612-11-0x00007FFE28B03000-0x00007FFE28B05000-memory.dmp

              Filesize

              8KB

            • memory/4928-27-0x0000000000A40000-0x0000000000A52000-memory.dmp

              Filesize

              72KB

            • memory/4928-29-0x0000000000A40000-0x0000000000A52000-memory.dmp

              Filesize

              72KB

            • memory/4928-31-0x0000000000A40000-0x0000000000A52000-memory.dmp

              Filesize

              72KB

            • memory/4928-32-0x0000000000600000-0x000000000062F000-memory.dmp

              Filesize

              188KB