Analysis
- max time kernel
60s - max time network
48s - platform
windows7_x64 - resource
win7-20220414-en - submitted
16/06/2022, 11:50
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.2776.exe
- Size 480KB
- Sample220616-nzkzzaefbr
- SHA256 d717d448e3430e4f325ff677e5d45ebe7e17ecaf6324f9aff852a5ed271c0dfc
Malware Config
Extracted
-
formbook
-
4.1
-
p07y
-
xn--1rwz2n.com
-
website-antivirus.com
-
getchug.com
-
usmuz.com
-
lacoccinellebypeps.be
-
constantin.style
-
championsroutines.com
-
armstrongcoin.com
-
privatealtitude.com
-
tgmywatchwinder.com
-
theprimedia.com
-
seanlucy.com
-
dagjewegpagina.online
-
agilty-renewables.com
-
autocare.online
-
rajakartu99.xyz
-
saborcaseiromarmita.com
-
lambert.website
-
blewmovieclub.com
-
sjrcqg.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.2776.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.2776.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.2776.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RRWyArgjni.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RRWyArgjni" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC5EF.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.2776.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.2776.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmpC5EF.tmp
d93f411851d7c929.customDestinations-ms
memory/536-55-0x0000000075B61000-0x0000000075B63000-memory.dmp
memory/536-56-0x0000000000240000-0x000000000024E000-memory.dmp
memory/536-57-0x0000000001260000-0x00000000012CC000-memory.dmp
memory/536-54-0x0000000001360000-0x00000000013D8000-memory.dmp
memory/536-65-0x0000000000FE0000-0x0000000001014000-memory.dmp
memory/956-69-0x0000000000400000-0x000000000042F000-memory.dmp
memory/956-66-0x0000000000400000-0x000000000042F000-memory.dmp
memory/956-67-0x0000000000400000-0x000000000042F000-memory.dmp
memory/956-71-0x00000000008F0000-0x0000000000BF3000-memory.dmp
memory/1324-72-0x000000006EC20000-0x000000006F1CB000-memory.dmp
memory/1324-75-0x000000006EC20000-0x000000006F1CB000-memory.dmp
memory/1356-73-0x000000006EC20000-0x000000006F1CB000-memory.dmp
memory/1356-74-0x000000006EC20000-0x000000006F1CB000-memory.dmp