Overview

overview

10

Static

static

3

FEDEX TRN ...54.exe

windows10-ltsc 2021-x64

10

Resubmissions

09-11-2024 17:20

241109-vwrrns1pdm 10

09-11-2024 14:21

241109-rnzkrswdpq 10

Analysis

  • max time kernel
    91s
  • max time network
    87s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    09-11-2024 17:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FEDEX TRN 771893954554.exe

  • Size

    2.2MB

  • MD5

    22b365e10dd635468212251994b194bf

  • SHA1

    069d6d2395ec518d0156b6d02519d3b8e896e5b5

  • SHA256

    7f9b8fcc527d02e66b49d76ff52297d69dbf237a8dd4342fdf3f49a2189c67d0

  • SHA512

    fbb27e9c38a6f351edd756b00227c42b98bf08c89c1c85e3b74462a381b61e4347972f373327f540b5744ef661ed0c1b3072b188616d5a5950478720bddefb1b

  • SSDEEP

    24576:iB26eZ4fTPkhZ2PAG0pMn6+YZ8IOxSD68Q81Zr6kNefAd/YK2HzQX9Kub+YSgrBK:Zhhj+EbjDE81R6iY7O

Score
10/10
formbookoa09discoveryevasionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

oa09

Decoy

grit.careers

kingthaivegas.com

onwingirisleri.net

radio-jesus.com

forestfairiesnft.com

healthyintimatelifestyle.africa

karamoghanasti.africa

gqujtf.com

chaindenmark.com

netzerosemitechnologies.co.uk

kakekpecah1000.com

fiddler-foaled.click

adventurepsychologist.com

miletong.net

discounttirestoresinc.com

goldmanmediaent.com

entsorgunglangnau.ch

brezop.xyz

24-02-2022.site

artificialgrassminneapolis.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook family
    formbook
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Formbook payload 4 IoCs
    rat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 4 IoCs
  • YARA rule for Mozi IoT Botnet 1 IoCs

    Mozi IoT Botnet detection.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Users\Admin\AppData\Local\Temp\FEDEX TRN 771893954554.exe
      "C:\Users\Admin\AppData\Local\Temp\FEDEX TRN 771893954554.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1928
      • C:\Users\Admin\AppData\Local\Temp\FEDEX TRN 771893954554.exe
        "C:\Users\Admin\AppData\Local\Temp\FEDEX TRN 771893954554.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4016
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\FEDEX TRN 771893954554.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1568
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4364

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rpzcygpo.nwo.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/1704-48-0x0000000000D70000-0x0000000000D9F000-memory.dmp

      Filesize

      188KB

      Download

    • memory/1704-46-0x0000000000F70000-0x0000000000F87000-memory.dmp

      Filesize

      92KB

      Download

    • memory/1704-45-0x0000000000F70000-0x0000000000F87000-memory.dmp

      Filesize

      92KB

      Download

    • memory/1928-26-0x0000000007460000-0x0000000007ADA000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/1928-27-0x0000000006150000-0x000000000616A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/1928-34-0x0000000074370000-0x0000000074B21000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1928-30-0x0000000074370000-0x0000000074B21000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1928-8-0x00000000045C0000-0x00000000045F6000-memory.dmp

      Filesize

      216KB

      Download

    • memory/1928-9-0x0000000074370000-0x0000000074B21000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1928-10-0x0000000074370000-0x0000000074B21000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1928-11-0x0000000004E10000-0x00000000054DA000-memory.dmp

      Filesize

      6.8MB

      Download

    • memory/1928-12-0x0000000074370000-0x0000000074B21000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1928-13-0x0000000005550000-0x00000000055B6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1928-14-0x0000000005630000-0x0000000005696000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1928-25-0x0000000005D80000-0x0000000005DCC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/1928-24-0x0000000005C30000-0x0000000005C4E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/3608-42-0x000000000F820000-0x000000000F8F1000-memory.dmp

      Filesize

      836KB

      Download

    • memory/3608-50-0x00000000133C0000-0x000000001354E000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/3608-47-0x000000000F820000-0x000000000F8F1000-memory.dmp

      Filesize

      836KB

      Download

    • memory/4016-35-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

      Download

    • memory/4016-44-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

      Download

    • memory/4016-40-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

      Download

    • memory/4016-41-0x0000000001940000-0x0000000001954000-memory.dmp

      Filesize

      80KB

      Download

    • memory/4016-38-0x0000000001970000-0x0000000001CBC000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/4052-4-0x0000000005990000-0x0000000005A22000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4052-37-0x0000000074370000-0x0000000074B21000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4052-6-0x0000000005A80000-0x0000000005AA2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4052-7-0x0000000005AB0000-0x0000000005E07000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/4052-28-0x000000007437E000-0x000000007437F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4052-29-0x0000000074370000-0x0000000074B21000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4052-3-0x0000000005960000-0x0000000005994000-memory.dmp

      Filesize

      208KB

      Download

    • memory/4052-2-0x0000000005710000-0x0000000005866000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/4052-5-0x0000000074370000-0x0000000074B21000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4052-1-0x00000000008E0000-0x0000000000B22000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/4052-0-0x000000007437E000-0x000000007437F000-memory.dmp

      Filesize

      4KB

      Download