Analysis
- max time kernel
130s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
24/03/2022, 09:35
General
- Target 9326cb1f30e786f29ca93604a290116d.exe
- Size 997KB
- Sample220324-lke43abgap
- SHA256 e073516efee850dda1e008bcd82c3160cb867dda001bec42d76f6aa6af82a257
Malware Config
Extracted
-
formbook
-
4.1
-
gh6c
-
onlinesuppershopbd.xyz
-
shbd666k.com
-
nephrodialysis.com
-
why88.top
-
babouceesay.com
-
imgur.online
-
sistemasap.com
-
whwes.com
-
tw74m0gdcr.xyz
-
cantaregrupoinmobiliario.com
-
risiko-nein-danke.com
-
interfacejazz.com
-
rcde.cat
-
xxjcrj.com
-
moonboat.pro
-
simpcraft.club
-
keylockrepair.com
-
landslending.com
-
pocytochos.top
-
tooozi.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9326cb1f30e786f29ca93604a290116d.exe"C:\Users\Admin\AppData\Local\Temp\9326cb1f30e786f29ca93604a290116d.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9326cb1f30e786f29ca93604a290116d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\9326cb1f30e786f29ca93604a290116d.exe"C:\Users\Admin\AppData\Local\Temp\9326cb1f30e786f29ca93604a290116d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/912-148-0x0000000006160000-0x000000000617E000-memory.dmp
memory/912-152-0x0000000007130000-0x00000000071C6000-memory.dmp
memory/912-155-0x00000000071D0000-0x00000000071D8000-memory.dmp
memory/912-154-0x00000000071F0000-0x000000000720A000-memory.dmp
memory/912-153-0x00000000070E0000-0x00000000070EE000-memory.dmp
memory/912-151-0x0000000006F20000-0x0000000006F2A000-memory.dmp
memory/912-137-0x0000000004620000-0x0000000004656000-memory.dmp
memory/912-138-0x0000000004DE0000-0x0000000005408000-memory.dmp
memory/912-150-0x0000000006EB0000-0x0000000006ECA000-memory.dmp
memory/912-149-0x0000000007500000-0x0000000007B7A000-memory.dmp
memory/912-141-0x0000000004AF0000-0x0000000004B12000-memory.dmp
memory/912-144-0x0000000005BB0000-0x0000000005BCE000-memory.dmp
memory/912-142-0x0000000005410000-0x0000000005476000-memory.dmp
memory/912-147-0x0000000071070000-0x00000000710BC000-memory.dmp
memory/912-145-0x00000000047A5000-0x00000000047A7000-memory.dmp
memory/912-146-0x0000000006B50000-0x0000000006B82000-memory.dmp
memory/1528-130-0x0000000000BB0000-0x0000000000CAE000-memory.dmp
memory/1528-131-0x0000000005DA0000-0x0000000006344000-memory.dmp
memory/1528-136-0x0000000009810000-0x0000000009876000-memory.dmp
memory/1528-134-0x0000000009240000-0x00000000092DC000-memory.dmp
memory/1528-133-0x0000000005650000-0x000000000565A000-memory.dmp
memory/1528-132-0x00000000056B0000-0x0000000005742000-memory.dmp
memory/2984-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2984-143-0x0000000001A20000-0x0000000001D6A000-memory.dmp