Analysis
- max time kernel
91s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/06/2022, 03:33
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.21969.exe
- Size 486KB
- Sample220621-d362haader
- SHA256 cddd7c5798303f779782f6d34ce93034647e5984f9b52f259e030201b538fc3d
Malware Config
Extracted
-
formbook
-
4.1
-
en83
-
audubonenv.com
-
themrbeastgames.com
-
getcampusnations.com
-
eroptik.online
-
zghy.tours
-
95623.maison
-
hongsencraft.com
-
mymelada.com
-
healthexpertfund.com
-
qings.online
-
gma-seen.com
-
thevirtualeventsheroes.com
-
kykn8sghjadg.com
-
metformin100years.com
-
cliverof.com
-
dadsimprov.com
-
amerikanewsu.com
-
findhypeart.com
-
p2pilive.com
-
sacramentoproudboys.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.21969.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.21969.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CpWQsbbJfeq.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CpWQsbbJfeq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp81E2.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.21969.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.21969.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp81E2.tmp
memory/1132-146-0x0000000000FB0000-0x00000000012FA000-memory.dmp
memory/1132-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1500-131-0x0000000004F80000-0x0000000005524000-memory.dmp
memory/1500-132-0x00000000049D0000-0x0000000004A62000-memory.dmp
memory/1500-133-0x00000000049B0000-0x00000000049BA000-memory.dmp
memory/1500-134-0x0000000008380000-0x000000000841C000-memory.dmp
memory/1500-130-0x00000000000F0000-0x0000000000170000-memory.dmp
memory/2264-139-0x0000000004EB0000-0x00000000054D8000-memory.dmp
memory/2264-148-0x0000000071660000-0x00000000716AC000-memory.dmp
memory/2264-143-0x0000000004DC0000-0x0000000004E26000-memory.dmp
memory/2264-144-0x00000000054E0000-0x0000000005546000-memory.dmp
memory/2264-145-0x0000000005B00000-0x0000000005B1E000-memory.dmp
memory/2264-137-0x0000000002200000-0x0000000002236000-memory.dmp
memory/2264-147-0x00000000060D0000-0x0000000006102000-memory.dmp
memory/2264-149-0x0000000006090000-0x00000000060AE000-memory.dmp
memory/2264-142-0x0000000004B40000-0x0000000004B62000-memory.dmp
memory/2264-151-0x0000000006E10000-0x0000000006E2A000-memory.dmp
memory/2264-150-0x0000000007450000-0x0000000007ACA000-memory.dmp
memory/2264-152-0x0000000006E80000-0x0000000006E8A000-memory.dmp
memory/2264-153-0x0000000007090000-0x0000000007126000-memory.dmp
memory/2264-154-0x0000000007040000-0x000000000704E000-memory.dmp
memory/2264-155-0x0000000007150000-0x000000000716A000-memory.dmp
memory/2264-156-0x0000000007130000-0x0000000007138000-memory.dmp