Analysis
- max time kernel
110s - max time network
123s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
25/11/2021, 21:47
General
- Target 06ab8c9ec1bfcbf7da7f34b7b0a74d15.exe
- Size 459KB
- Sample211125-1m7dnaghen
- SHA256 f09288cc78739d3ea28dec0e501c7aa01cf695b0d642f56b7edddf09b42867e3
Malware Config
Extracted
-
formbook
-
4.1
-
x2bt
-
http://www.hudsoncm.com/x2bt/
-
widgetbaby.com
-
bkawkobbkaskbkw.com
-
vinaligroup.com
-
carsphurbrfroebresny.com
-
iefjikefgj.space
-
nailsbynelu.com
-
yangyuechen.com
-
bjyuhualong.com
-
dduedleh.xyz
-
metabolique.xyz
-
getseashell.pro
-
amhempresas.com
-
comtejyun9.site
-
daphnneamiosci.com
-
nooble.xyz
-
libertystorageks.com
-
kottolyzer.com
-
latreeti.xyz
-
replicator.one
-
samarindavirtualtour.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06ab8c9ec1bfcbf7da7f34b7b0a74d15.exe"C:\Users\Admin\AppData\Local\Temp\06ab8c9ec1bfcbf7da7f34b7b0a74d15.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\06ab8c9ec1bfcbf7da7f34b7b0a74d15.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\06ab8c9ec1bfcbf7da7f34b7b0a74d15.exe"C:\Users\Admin\AppData\Local\Temp\06ab8c9ec1bfcbf7da7f34b7b0a74d15.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\06ab8c9ec1bfcbf7da7f34b7b0a74d15.exe"C:\Users\Admin\AppData\Local\Temp\06ab8c9ec1bfcbf7da7f34b7b0a74d15.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\06ab8c9ec1bfcbf7da7f34b7b0a74d15.exe"C:\Users\Admin\AppData\Local\Temp\06ab8c9ec1bfcbf7da7f34b7b0a74d15.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1532-143-0x0000000001420000-0x0000000001740000-memory.dmp
memory/1532-133-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2884-141-0x0000000007630000-0x0000000007631000-memory.dmp
memory/2884-136-0x0000000006852000-0x0000000006853000-memory.dmp
memory/2884-205-0x0000000006853000-0x0000000006854000-memory.dmp
memory/2884-166-0x0000000009080000-0x0000000009081000-memory.dmp
memory/2884-165-0x0000000008EA0000-0x0000000008EA1000-memory.dmp
memory/2884-164-0x000000007EF40000-0x000000007EF41000-memory.dmp
memory/2884-159-0x0000000008D30000-0x0000000008D31000-memory.dmp
memory/2884-152-0x0000000008D70000-0x0000000008DA3000-memory.dmp
memory/2884-135-0x0000000006850000-0x0000000006851000-memory.dmp
memory/2884-145-0x0000000004170000-0x0000000004171000-memory.dmp
memory/2884-130-0x0000000004170000-0x0000000004171000-memory.dmp
memory/2884-129-0x0000000004170000-0x0000000004171000-memory.dmp
memory/2884-131-0x0000000004290000-0x0000000004291000-memory.dmp
memory/2884-132-0x0000000006E90000-0x0000000006E91000-memory.dmp
memory/2884-144-0x0000000007DF0000-0x0000000007DF1000-memory.dmp
memory/2884-142-0x0000000007B00000-0x0000000007B01000-memory.dmp
memory/2884-140-0x00000000076B0000-0x00000000076B1000-memory.dmp
memory/2884-137-0x0000000006D10000-0x0000000006D11000-memory.dmp
memory/2884-138-0x00000000075C0000-0x00000000075C1000-memory.dmp
memory/4092-118-0x0000000005880000-0x0000000005881000-memory.dmp
memory/4092-115-0x0000000000D20000-0x0000000000D21000-memory.dmp
memory/4092-119-0x00000000059D0000-0x00000000059D1000-memory.dmp
memory/4092-117-0x0000000003310000-0x0000000003311000-memory.dmp
memory/4092-120-0x0000000005B70000-0x0000000005B71000-memory.dmp
memory/4092-128-0x0000000006AE0000-0x0000000006AE1000-memory.dmp
memory/4092-126-0x0000000006C70000-0x0000000006C71000-memory.dmp
memory/4092-125-0x0000000006700000-0x0000000006761000-memory.dmp
memory/4092-124-0x0000000006560000-0x0000000006561000-memory.dmp
memory/4092-123-0x00000000061D0000-0x00000000061D1000-memory.dmp
memory/4092-122-0x0000000003313000-0x0000000003315000-memory.dmp
memory/4092-121-0x0000000005990000-0x0000000005998000-memory.dmp