Analysis
- max time kernel
152s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
18/01/2022, 08:21
General
- Target QUOTATION-PDF- SCAN COPY.exe
- Size 402KB
- Sample220118-j81dssadhq
- SHA256 b0d65cf9bd6e65d3d8681b4366ceaa50cebea2895a960a2ea9972fe07a09d614
Malware Config
Extracted
-
formbook
-
4.1
-
m17y
-
dental-implants-us-prices.site
-
eolegends.online
-
drskinstudio.com
-
miamivideomapping.com
-
cqytwater.com
-
fesfe.net
-
dlautostore.com
-
wwwpledge.com
-
trynutiliti.com
-
551milesoak.com
-
jemmetalfab.com
-
teamtrinitysellsncarolina.com
-
injurypersonallawyer.com
-
r3qcf2.xyz
-
djellaba-boutique.com
-
t6fwagd.xyz
-
lm-upto100.com
-
shyashijz.com
-
classicbasilicata.com
-
exactias.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hLPZERniYoGl.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hLPZERniYoGl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3DFC.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1564-142-0x0000000006AA0000-0x0000000006AA1000-memory.dmp
memory/1564-164-0x0000000009560000-0x000000000957A000-memory.dmp
memory/1564-163-0x0000000009450000-0x000000000945E000-memory.dmp
memory/1564-162-0x0000000009490000-0x0000000009526000-memory.dmp
memory/1564-137-0x0000000006960000-0x0000000006996000-memory.dmp
memory/1564-165-0x0000000009540000-0x0000000009548000-memory.dmp
memory/1564-139-0x00000000070E0000-0x0000000007708000-memory.dmp
memory/1564-158-0x0000000009280000-0x000000000928A000-memory.dmp
memory/1564-152-0x0000000006AA5000-0x0000000006AA7000-memory.dmp
memory/1564-141-0x0000000006E60000-0x0000000006E82000-memory.dmp
memory/1564-145-0x0000000007900000-0x0000000007966000-memory.dmp
memory/1564-143-0x0000000007000000-0x0000000007066000-memory.dmp
memory/1564-144-0x0000000006AA2000-0x0000000006AA3000-memory.dmp
memory/1564-147-0x0000000007F10000-0x0000000007F2E000-memory.dmp
memory/1564-157-0x0000000009210000-0x000000000922A000-memory.dmp
memory/1564-156-0x0000000009850000-0x0000000009ECA000-memory.dmp
memory/1564-155-0x0000000008EC0000-0x0000000008EDE000-memory.dmp
memory/1564-151-0x00000000084D0000-0x0000000008502000-memory.dmp
memory/1564-153-0x0000000070640000-0x000000007068C000-memory.dmp
memory/1564-154-0x000000007F670000-0x000000007F671000-memory.dmp
memory/1672-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1672-149-0x0000000001540000-0x0000000001555000-memory.dmp
memory/1672-148-0x0000000001570000-0x0000000001D1A000-memory.dmp
memory/2564-150-0x00000000088A0000-0x0000000008A06000-memory.dmp
memory/2564-168-0x0000000008A10000-0x0000000008BA0000-memory.dmp
memory/2912-167-0x0000000005170000-0x0000000005204000-memory.dmp
memory/2912-159-0x0000000000750000-0x000000000075A000-memory.dmp
memory/2912-160-0x0000000004C00000-0x0000000004C2F000-memory.dmp
memory/2912-161-0x0000000005310000-0x000000000565A000-memory.dmp
memory/2968-130-0x0000000000BE0000-0x0000000000C4A000-memory.dmp
memory/2968-132-0x00000000057C0000-0x0000000005852000-memory.dmp
memory/2968-131-0x00000000057B0000-0x00000000057B1000-memory.dmp
memory/2968-133-0x0000000005DF0000-0x0000000005E8C000-memory.dmp
memory/2968-134-0x0000000006650000-0x0000000006BF4000-memory.dmp