Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/04/2022, 07:31
General
- Target cb7d4c1dc8b01bf82bb52937e5deeac4.exe
- Size 241KB
- Sample220408-jcc9dsfcbr
- SHA256 bb4c6c01b5e866d18d6d6559242b42e79ca9980cd9dfa0db7b4331395a6b5204
Malware Config
Extracted
-
formbook
-
4.1
-
nk6l
-
cbnextra.com
-
entitysystemsinc.com
-
55midwoodave.com
-
ebelizzi.com
-
khojcity.com
-
1527brokenoakdrive.site
-
housinghproperties.com
-
ratiousa.com
-
lrcrepresentacoes.net
-
tocoec.net
-
khadamatdemnate.com
-
davidkastner.xyz
-
gardeniaresort.com
-
qiantangguoji.com
-
visaprepaidprocessinq.com
-
cristinamadara.com
-
semapisus.xyz
-
mpwebagency.net
-
alibabasdeli.com
-
gigasupplies.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb7d4c1dc8b01bf82bb52937e5deeac4.exe"C:\Users\Admin\AppData\Local\Temp\cb7d4c1dc8b01bf82bb52937e5deeac4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uyzzokhns.exeC:\Users\Admin\AppData\Local\Temp\uyzzokhns.exe C:\Users\Admin\AppData\Local\Temp\exhfalpw3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uyzzokhns.exeC:\Users\Admin\AppData\Local\Temp\uyzzokhns.exe C:\Users\Admin\AppData\Local\Temp\exhfalpw4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\uyzzokhns.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
exhfalpw
uyzzokhns.exe
uyzzokhns.exe
uyzzokhns.exe
zq3jossht9qtwr9qc
memory/1512-145-0x0000000000B50000-0x0000000000BA7000-memory.dmp
memory/1512-146-0x00000000008C0000-0x00000000008EF000-memory.dmp
memory/1512-147-0x0000000002A40000-0x0000000002D8A000-memory.dmp
memory/1512-148-0x0000000002770000-0x0000000002803000-memory.dmp
memory/3044-142-0x0000000007F70000-0x0000000008113000-memory.dmp
memory/3044-149-0x0000000008120000-0x000000000826C000-memory.dmp
memory/4328-136-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4328-140-0x0000000000A40000-0x0000000000D8A000-memory.dmp
memory/4328-141-0x00000000009E0000-0x00000000009F4000-memory.dmp
memory/4612-138-0x0000000000450000-0x0000000000452000-memory.dmp