Analysis
- max time kernel
151s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
07/04/2022, 10:24
General
- Target LISTA DE PEDIDO.exe
- Size 509KB
- Sample220407-mfczksbfcn
- SHA256 b5cde2a22949e65c3eb965bec3fe21cc3edd2d83e5a1631bd705ab8f649daff7
Malware Config
Extracted
-
formbook
-
4.1
-
gn27
-
perilunevc.com
-
kantogaming.com
-
stageyor.online
-
jixsux.site
-
dingmei2020.icu
-
savagesupplyco.com
-
deadstockllc.com
-
leyandfey.com
-
zjn22558800.com
-
projectupskill.net
-
outliersresearch.com
-
spaced.community
-
zschengbangzx.com
-
5gxzxxtax-ety7f.biz
-
iq0xe.com
-
6388xp9xg9k.com
-
hengyungdzz.com
-
retrosale.com
-
echt.global
-
canceltotalav.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 49 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LISTA DE PEDIDO.exe"C:\Users\Admin\AppData\Local\Temp\LISTA DE PEDIDO.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ftplVJDAYJhabQ.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ftplVJDAYJhabQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFDED.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmpFDED.tmp
memory/2596-160-0x0000000000C20000-0x0000000000CB3000-memory.dmp
memory/2596-145-0x00000000008F0000-0x000000000094A000-memory.dmp
memory/2596-146-0x0000000000600000-0x000000000062F000-memory.dmp
memory/2596-147-0x0000000001080000-0x00000000013CA000-memory.dmp
memory/2800-136-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2800-139-0x0000000001730000-0x0000000001A7A000-memory.dmp
memory/2800-141-0x00000000016F0000-0x0000000001704000-memory.dmp
memory/3028-161-0x00000000085A0000-0x0000000008722000-memory.dmp
memory/3028-142-0x0000000002FF0000-0x00000000030EB000-memory.dmp
memory/3404-129-0x00000000095F0000-0x0000000009656000-memory.dmp
memory/3404-128-0x0000000009140000-0x00000000091DC000-memory.dmp
memory/3404-127-0x0000000005900000-0x000000000590A000-memory.dmp
memory/3404-124-0x0000000000ED0000-0x0000000000F56000-memory.dmp
memory/3404-126-0x00000000059A0000-0x0000000005A32000-memory.dmp
memory/3404-125-0x0000000005EB0000-0x0000000006454000-memory.dmp
memory/3492-143-0x0000000005E80000-0x0000000005E9E000-memory.dmp
memory/3492-156-0x0000000007490000-0x0000000007526000-memory.dmp
memory/3492-137-0x0000000005050000-0x0000000005072000-memory.dmp
memory/3492-135-0x0000000005110000-0x0000000005738000-memory.dmp
memory/3492-132-0x00000000025D0000-0x0000000002606000-memory.dmp
memory/3492-149-0x0000000002735000-0x0000000002737000-memory.dmp
memory/3492-150-0x0000000006EC0000-0x0000000006EF2000-memory.dmp
memory/3492-151-0x0000000071840000-0x000000007188C000-memory.dmp
memory/3492-152-0x00000000064C0000-0x00000000064DE000-memory.dmp
memory/3492-153-0x0000000007850000-0x0000000007ECA000-memory.dmp
memory/3492-154-0x0000000007210000-0x000000000722A000-memory.dmp
memory/3492-155-0x0000000007280000-0x000000000728A000-memory.dmp
memory/3492-138-0x0000000005810000-0x0000000005876000-memory.dmp
memory/3492-157-0x0000000007440000-0x000000000744E000-memory.dmp
memory/3492-158-0x0000000007550000-0x000000000756A000-memory.dmp
memory/3492-159-0x0000000007530000-0x0000000007538000-memory.dmp