Analysis
- max time kernel
162s - max time network
155s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/01/2022, 08:30
General
- Target LVvoucher.exe
- Size 779KB
- Sample220128-kd64jaade3
- SHA256 77604e2646be4fb59a16e33ca5e78a73ec5045b8f1cce6f5ba16c11304b1c2ee
Malware Config
Extracted
-
formbook
-
4.1
-
oh75
-
denizgidam.com
-
6cc06.com
-
charlottewaldburgzeil.com
-
medijanus.com
-
qingdaoyiersan.com
-
datcabilgisayar.xyz
-
111439d.com
-
xn--1ruo40k.com
-
wu6enxwcx5h3.xyz
-
vnscloud.net
-
brtka.xyz
-
showztime.com
-
promocoesdedezenbro.com
-
wokpy.com
-
chnowuk.online
-
rockshotscafe.com
-
pelrjy.com
-
nato-riness.com
-
feixiang-chem.com
-
thcoinexchange.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 37 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LVvoucher.exe"C:\Users\Admin\AppData\Local\Temp\LVvoucher.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UcgxBJ.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UcgxBJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6AA8.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\LVvoucher.exe"C:\Users\Admin\AppData\Local\Temp\LVvoucher.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\LVvoucher.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/372-377-0x0000000003390000-0x0000000003522000-memory.dmp
memory/372-149-0x0000000003530000-0x0000000003850000-memory.dmp
memory/372-147-0x0000000000EB0000-0x0000000000ECE000-memory.dmp
memory/372-148-0x0000000000B80000-0x0000000000BAF000-memory.dmp
memory/772-156-0x0000000009640000-0x0000000009673000-memory.dmp
memory/772-141-0x0000000007E20000-0x0000000008170000-memory.dmp
memory/772-363-0x00000000098D0000-0x00000000098D8000-memory.dmp
memory/772-358-0x00000000098E0000-0x00000000098FA000-memory.dmp
memory/772-129-0x0000000004A70000-0x0000000004AA6000-memory.dmp
memory/772-201-0x0000000004BA3000-0x0000000004BA4000-memory.dmp
memory/772-131-0x0000000007530000-0x0000000007B58000-memory.dmp
memory/772-133-0x0000000004BA2000-0x0000000004BA3000-memory.dmp
memory/772-132-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/772-135-0x00000000073B0000-0x00000000073D2000-memory.dmp
memory/772-136-0x0000000007CB0000-0x0000000007D16000-memory.dmp
memory/772-137-0x0000000007BD0000-0x0000000007C36000-memory.dmp
memory/772-164-0x0000000009960000-0x00000000099F4000-memory.dmp
memory/772-163-0x000000007EAA0000-0x000000007EAA1000-memory.dmp
memory/772-162-0x0000000009770000-0x0000000009815000-memory.dmp
memory/772-157-0x0000000009600000-0x000000000961E000-memory.dmp
memory/772-142-0x0000000007C80000-0x0000000007C9C000-memory.dmp
memory/772-143-0x00000000082B0000-0x00000000082FB000-memory.dmp
memory/772-144-0x00000000085B0000-0x0000000008626000-memory.dmp
memory/912-123-0x00000000071B0000-0x00000000071BC000-memory.dmp
memory/912-121-0x0000000004AF0000-0x0000000004FEE000-memory.dmp
memory/912-120-0x0000000004B90000-0x0000000004C22000-memory.dmp
memory/912-118-0x0000000000200000-0x00000000002CA000-memory.dmp
memory/912-124-0x00000000074E0000-0x000000000757C000-memory.dmp
memory/912-122-0x0000000004B20000-0x0000000004B2A000-memory.dmp
memory/912-125-0x00000000077A0000-0x000000000780A000-memory.dmp
memory/912-119-0x0000000004FF0000-0x00000000054EE000-memory.dmp
memory/3056-140-0x0000000005C10000-0x0000000005D3D000-memory.dmp
memory/3056-378-0x0000000005D40000-0x0000000005EB9000-memory.dmp
memory/3828-139-0x0000000000BE0000-0x0000000000BF4000-memory.dmp
memory/3828-138-0x0000000001040000-0x0000000001360000-memory.dmp
memory/3828-130-0x0000000000400000-0x000000000042F000-memory.dmp