Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
17/06/2022, 06:42
General
- Target soa-jun22.exe
- Size 1015KB
- Sample220617-hgb2fsdch7
- SHA256 7f6242e9dcb1ce45c70b22d3c87b36b04fbc0b65d7f7ec07b008693d8763b66b
Malware Config
Extracted
-
formbook
-
4.1
-
fs44
-
whneat.com
-
jljcw.net
-
pocodelivery.com
-
outofplacezine.com
-
yavuzcansigorta.com
-
xinhewood-cn.com
-
cartogogh.com
-
5avis.com
-
joyceyong.art
-
digitalsurf.community
-
blackcreekbarns.com
-
magazinedistribuidor.com
-
sportsgross.com
-
drevom.online
-
mayibeofservice.com
-
gareloi-digit.com
-
permitha.net
-
renaissanceestetica.com
-
facts-r-friends.com
-
dach-loc.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 5 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Delays execution with timeout.exe 1 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\soa-jun22.exe"C:\Users\Admin\AppData\Local\Temp\soa-jun22.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 10;Start-Sleep -Seconds 10;3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 104⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/220-154-0x0000000000400000-0x000000000042F000-memory.dmp
memory/220-151-0x0000000003200000-0x0000000003214000-memory.dmp
memory/220-148-0x0000000001490000-0x00000000014A4000-memory.dmp
memory/220-147-0x00000000014B0000-0x00000000017FA000-memory.dmp
memory/220-146-0x0000000000400000-0x000000000042F000-memory.dmp
memory/220-144-0x0000000000400000-0x000000000042F000-memory.dmp
memory/864-161-0x00000000007D0000-0x00000000007FF000-memory.dmp
memory/864-159-0x0000000001010000-0x00000000010A3000-memory.dmp
memory/864-157-0x00000000011E0000-0x000000000152A000-memory.dmp
memory/864-156-0x00000000007D0000-0x00000000007FF000-memory.dmp
memory/864-155-0x00000000002E0000-0x00000000002EB000-memory.dmp
memory/1616-130-0x0000000000C70000-0x0000000000D74000-memory.dmp
memory/1616-142-0x00000000277B0000-0x0000000027842000-memory.dmp
memory/2580-137-0x0000000006200000-0x000000000621E000-memory.dmp
memory/2580-139-0x00000000066F0000-0x000000000670A000-memory.dmp
memory/2580-132-0x0000000004BE0000-0x0000000004C16000-memory.dmp
memory/2580-133-0x0000000005250000-0x0000000005878000-memory.dmp
memory/2580-134-0x00000000051B0000-0x00000000051D2000-memory.dmp
memory/2580-135-0x0000000005A30000-0x0000000005A96000-memory.dmp
memory/2580-136-0x0000000005B50000-0x0000000005BB6000-memory.dmp
memory/2580-138-0x0000000007A60000-0x00000000080DA000-memory.dmp
memory/3168-152-0x0000000006FE0000-0x00000000070D3000-memory.dmp
memory/3168-160-0x0000000007EF0000-0x000000000802A000-memory.dmp
memory/3168-149-0x0000000002820000-0x000000000291C000-memory.dmp
memory/3168-162-0x0000000007EF0000-0x000000000802A000-memory.dmp