Analysis
- max time kernel
185s - max time network
204s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
16/06/2022, 11:50
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.2776.exe
- Size 480KB
- Sample220616-nzkzzaefbr
- SHA256 d717d448e3430e4f325ff677e5d45ebe7e17ecaf6324f9aff852a5ed271c0dfc
Malware Config
Extracted
-
formbook
-
4.1
-
p07y
-
xn--1rwz2n.com
-
website-antivirus.com
-
getchug.com
-
usmuz.com
-
lacoccinellebypeps.be
-
constantin.style
-
championsroutines.com
-
armstrongcoin.com
-
privatealtitude.com
-
tgmywatchwinder.com
-
theprimedia.com
-
seanlucy.com
-
dagjewegpagina.online
-
agilty-renewables.com
-
autocare.online
-
rajakartu99.xyz
-
saborcaseiromarmita.com
-
lambert.website
-
blewmovieclub.com
-
sjrcqg.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.2776.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.2776.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.2776.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RRWyArgjni.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RRWyArgjni" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2D93.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.2776.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.2776.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
tmp2D93.tmp
memory/608-147-0x0000000001630000-0x000000000197A000-memory.dmp
memory/608-145-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3060-154-0x0000000007C50000-0x0000000007C5A000-memory.dmp
memory/3060-156-0x0000000007E10000-0x0000000007E1E000-memory.dmp
memory/3060-138-0x0000000002F60000-0x0000000002F96000-memory.dmp
memory/3060-139-0x0000000005970000-0x0000000005F98000-memory.dmp
memory/3060-155-0x0000000007E60000-0x0000000007EF6000-memory.dmp
memory/3060-141-0x00000000060A0000-0x0000000006106000-memory.dmp
memory/3060-149-0x00000000759E0000-0x0000000075A2C000-memory.dmp
memory/3060-152-0x0000000007BE0000-0x0000000007BFA000-memory.dmp
memory/3060-146-0x00000000068C0000-0x00000000068DE000-memory.dmp
memory/3264-132-0x0000000005610000-0x00000000056A2000-memory.dmp
memory/3264-133-0x00000000055D0000-0x00000000055DA000-memory.dmp
memory/3264-131-0x0000000005CB0000-0x0000000006254000-memory.dmp
memory/3264-134-0x0000000008180000-0x000000000821C000-memory.dmp
memory/3264-130-0x0000000000BD0000-0x0000000000C48000-memory.dmp
memory/3864-151-0x0000000006B30000-0x0000000006B4E000-memory.dmp
memory/3864-150-0x00000000759E0000-0x0000000075A2C000-memory.dmp
memory/3864-153-0x0000000007EE0000-0x000000000855A000-memory.dmp
memory/3864-148-0x0000000006B50000-0x0000000006B82000-memory.dmp
memory/3864-142-0x0000000005CC0000-0x0000000005D26000-memory.dmp
memory/3864-140-0x0000000005440000-0x0000000005462000-memory.dmp
memory/3864-157-0x0000000007BE0000-0x0000000007BFA000-memory.dmp
memory/3864-158-0x0000000007BC0000-0x0000000007BC8000-memory.dmp