Analysis
- max time kernel
151s - max time network
143s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
02/01/2022, 15:18
General
- Target Quote.exe
- Size 425KB
- Sample220102-spl7haghhp
- SHA256 e7e96e3fcdf2d9539c750c66f509c8d9d8d9a68e0fa2d944464b4095df875fda
Malware Config
Extracted
-
formbook
-
4.1
-
p3mp
-
letsblessthismess.com
-
alphaaba.com
-
thefutureofxec.com
-
starfamilybigspring.com
-
nodomainavailable.com
-
leannemstudios.com
-
athleticdadbod.com
-
bzyuhao.net
-
judgeoconnell.com
-
cleanenergymorocco.com
-
t0d4y-pla1.com
-
wzxiaomi.com
-
qnbyzmzklsf.com
-
gregorybank.com
-
a-prime-es-filtro-de-agua.fyi
-
krishrmenon.com
-
indertra.com
-
carbonpositivefanexperience.com
-
besttriptourism.com
-
cybercafe.pro
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 47 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quote.exe"C:\Users\Admin\AppData\Local\Temp\Quote.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IrlJIuprnm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IrlJIuprnm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB08F.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Quote.exe"C:\Users\Admin\AppData\Local\Temp\Quote.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quote.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/440-389-0x00000000042A0000-0x0000000004334000-memory.dmp
memory/440-166-0x00000000044E0000-0x0000000004800000-memory.dmp
memory/440-161-0x0000000002810000-0x000000000283F000-memory.dmp
memory/440-159-0x0000000000280000-0x0000000000296000-memory.dmp
memory/1204-143-0x0000000007010000-0x000000000702C000-memory.dmp
memory/1204-146-0x0000000000F70000-0x0000000000F71000-memory.dmp
memory/1204-379-0x0000000009700000-0x0000000009708000-memory.dmp
memory/1204-126-0x0000000000F70000-0x0000000000F71000-memory.dmp
memory/1204-127-0x0000000000F70000-0x0000000000F71000-memory.dmp
memory/1204-374-0x0000000009700000-0x0000000009708000-memory.dmp
memory/1204-129-0x0000000004990000-0x00000000049C6000-memory.dmp
memory/1204-373-0x0000000009710000-0x000000000972A000-memory.dmp
memory/1204-368-0x0000000009710000-0x000000000972A000-memory.dmp
memory/1204-132-0x0000000004980000-0x0000000004981000-memory.dmp
memory/1204-133-0x0000000004982000-0x0000000004983000-memory.dmp
memory/1204-134-0x0000000007620000-0x0000000007C48000-memory.dmp
memory/1204-135-0x0000000007290000-0x00000000072B2000-memory.dmp
memory/1204-137-0x0000000007430000-0x0000000007496000-memory.dmp
memory/1204-138-0x0000000007D50000-0x0000000007DB6000-memory.dmp
memory/1204-175-0x0000000009820000-0x00000000098B4000-memory.dmp
memory/1204-174-0x0000000004983000-0x0000000004984000-memory.dmp
memory/1204-173-0x0000000009430000-0x00000000094D5000-memory.dmp
memory/1204-140-0x0000000007DC0000-0x0000000008110000-memory.dmp
memory/1204-158-0x0000000007290000-0x00000000072B2000-memory.dmp
memory/1204-144-0x0000000008700000-0x000000000874B000-memory.dmp
memory/1204-145-0x00000000083D0000-0x0000000008446000-memory.dmp
memory/1204-160-0x0000000007430000-0x0000000007496000-memory.dmp
memory/1204-162-0x0000000007D50000-0x0000000007DB6000-memory.dmp
memory/1204-155-0x0000000007620000-0x0000000007C48000-memory.dmp
memory/1204-156-0x0000000009300000-0x0000000009333000-memory.dmp
memory/1204-157-0x0000000009300000-0x0000000009333000-memory.dmp
memory/1204-168-0x0000000008170000-0x000000000818E000-memory.dmp
memory/1204-165-0x0000000008700000-0x000000000874B000-memory.dmp
memory/1204-164-0x000000007EEC0000-0x000000007EEC1000-memory.dmp
memory/1204-167-0x00000000083D0000-0x0000000008446000-memory.dmp
memory/2072-142-0x0000000002AD0000-0x0000000002B9A000-memory.dmp
memory/2072-390-0x0000000005340000-0x0000000005465000-memory.dmp
memory/2904-130-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2904-139-0x0000000000F70000-0x0000000001290000-memory.dmp
memory/2904-141-0x0000000000E50000-0x0000000000E65000-memory.dmp
memory/3796-120-0x0000000004D20000-0x0000000004D2A000-memory.dmp
memory/3796-115-0x00000000002A0000-0x0000000000310000-memory.dmp
memory/3796-123-0x00000000086A0000-0x0000000008706000-memory.dmp
memory/3796-117-0x0000000005290000-0x000000000578E000-memory.dmp
memory/3796-119-0x0000000004BE0000-0x0000000004C72000-memory.dmp
memory/3796-121-0x0000000004F90000-0x000000000502C000-memory.dmp
memory/3796-122-0x0000000004F70000-0x0000000004F80000-memory.dmp
memory/3796-116-0x00000000002A0000-0x0000000000310000-memory.dmp
memory/3796-118-0x0000000004C80000-0x0000000004D12000-memory.dmp