Analysis
-
max time kernel
61s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-06-2022 03:39
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.22665.exe
-
Size
590KB
-
MD5
e49800b715646a9d30281adb67eedc80
-
SHA1
cde536845aa356ad2913f19145156a8289c999c6
-
SHA256
262fb779ec6fd7c58573c11480f2293f7680b38d3b62eb9acea9d228ed0a2f09
-
SHA512
df455c186e1a4c14d5bcd484ab18f97717887cbffe313abebbca8ed3f924492eab1f719b2e2fd4387a6e9ea99c119452c05de380d1daa4e8936fcd4a17eb408a
Malware Config
Extracted
formbook
4.1
t19g
playstationspiele.com
cakesbyannal.com
racepin.space
anti-offender.com
magnetque.com
farragorealtybrokerage.com
khuludmohammed.com
v33696.com
84ggg.com
d440.com
soccersmarthome.com
ofthis.world
fivestaryardcards.com
lusyard.com
gghft.com
viajesfortur.com
rationalirrationality.com
hanaramenrestaurant.com
exactlycleanse.com
martensenargentina.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22665.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22665.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qEPKLo.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qEPKLo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED1E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22665.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22665.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpED1E.tmpFilesize
1KB
MD56b102b87536879acdf62ad2891d72850
SHA1823983a81a48f0fdbf5612e68b52ef21bf5a6042
SHA256092a1c25f8cf673ece866b7001d66dcd39daed9d37fdbb3bc2ac1417f1d0d4bd
SHA512750ef912676eaa20198d6a840f0bb749698d36bf7e0f0c1dc31b1f93a96e2b0cdf64c17512f3aa6ec9d6fe999ba90fbbe6b5a0e3d18a2d8ae2a79db120f6c74d
-
memory/364-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/364-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/364-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/364-67-0x000000000041F1B0-mapping.dmp
-
memory/364-68-0x00000000009F0000-0x0000000000CF3000-memory.dmpFilesize
3.0MB
-
memory/952-58-0x0000000000000000-mapping.dmp
-
memory/952-69-0x000000006F1C0000-0x000000006F76B000-memory.dmpFilesize
5.7MB
-
memory/1412-59-0x0000000000000000-mapping.dmp
-
memory/1672-56-0x0000000000350000-0x000000000035C000-memory.dmpFilesize
48KB
-
memory/1672-57-0x0000000004F80000-0x0000000004FEC000-memory.dmpFilesize
432KB
-
memory/1672-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1672-62-0x0000000004420000-0x0000000004454000-memory.dmpFilesize
208KB
-
memory/1672-54-0x0000000000950000-0x00000000009EA000-memory.dmpFilesize
616KB