Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
18/01/2022, 11:25
General
- Target QUOTATION-PDF- SCAN COPY.exe
- Size 396KB
- Sample220118-nja5tsbafp
- SHA256 6403d40c99b5036c9410e11c11872bdceb1955da70a17bdb979cac381d09cc74
Malware Config
Extracted
-
formbook
-
4.1
-
m17y
-
dental-implants-us-prices.site
-
eolegends.online
-
drskinstudio.com
-
miamivideomapping.com
-
cqytwater.com
-
fesfe.net
-
dlautostore.com
-
wwwpledge.com
-
trynutiliti.com
-
551milesoak.com
-
jemmetalfab.com
-
teamtrinitysellsncarolina.com
-
injurypersonallawyer.com
-
r3qcf2.xyz
-
djellaba-boutique.com
-
t6fwagd.xyz
-
lm-upto100.com
-
shyashijz.com
-
classicbasilicata.com
-
exactias.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZVGfTKocv.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZVGfTKocv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCABB.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION-PDF- SCAN COPY.exe"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1700-131-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/1700-132-0x0000000005040000-0x00000000050D2000-memory.dmp
memory/1700-133-0x00000000056A0000-0x000000000573C000-memory.dmp
memory/1700-134-0x0000000005EB0000-0x0000000006454000-memory.dmp
memory/1700-130-0x0000000000470000-0x00000000004DA000-memory.dmp
memory/2428-149-0x00000000090A0000-0x0000000009227000-memory.dmp
memory/2428-168-0x0000000008D10000-0x0000000008E3D000-memory.dmp
memory/3096-159-0x00000000095D0000-0x00000000095EA000-memory.dmp
memory/3096-150-0x00000000082D0000-0x00000000082EE000-memory.dmp
memory/3096-142-0x0000000004A12000-0x0000000004A13000-memory.dmp
memory/3096-143-0x0000000007220000-0x0000000007242000-memory.dmp
memory/3096-144-0x0000000007BD0000-0x0000000007C36000-memory.dmp
memory/3096-145-0x0000000007CB0000-0x0000000007D16000-memory.dmp
memory/3096-137-0x0000000004990000-0x00000000049C6000-memory.dmp
memory/3096-165-0x0000000009900000-0x0000000009908000-memory.dmp
memory/3096-164-0x0000000009920000-0x000000000993A000-memory.dmp
memory/3096-161-0x0000000009640000-0x000000000964A000-memory.dmp
memory/3096-151-0x0000000004A15000-0x0000000004A17000-memory.dmp
memory/3096-152-0x0000000008890000-0x00000000088C2000-memory.dmp
memory/3096-153-0x0000000070F70000-0x0000000070FBC000-memory.dmp
memory/3096-154-0x0000000008870000-0x000000000888E000-memory.dmp
memory/3096-157-0x0000000009C20000-0x000000000A29A000-memory.dmp
memory/3096-163-0x0000000009810000-0x000000000981E000-memory.dmp
memory/3096-139-0x00000000075A0000-0x0000000007BC8000-memory.dmp
memory/3096-162-0x0000000009860000-0x00000000098F6000-memory.dmp
memory/3096-155-0x000000007FA40000-0x000000007FA41000-memory.dmp
memory/3096-141-0x0000000004A10000-0x0000000004A11000-memory.dmp
memory/3208-160-0x00000000032D0000-0x000000000522A000-memory.dmp
memory/3208-158-0x0000000002DB0000-0x0000000002DDF000-memory.dmp
memory/3208-156-0x00000000007E0000-0x00000000007F4000-memory.dmp
memory/3208-167-0x00000000032D0000-0x000000000522A000-memory.dmp
memory/3972-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3972-148-0x0000000001D50000-0x0000000001D65000-memory.dmp
memory/3972-147-0x0000000001400000-0x0000000001BBA000-memory.dmp