Analysis
- max time kernel
145s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
23/06/2022, 02:42
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.11307.exe
- Size 489KB
- Sample220623-c61hfsbdfm
- SHA256 26016e9aa9599971b46f615444f0cef3e1a56fe92fa2cbe49c4d14ac05822b13
Malware Config
Extracted
-
formbook
-
4.1
-
as47
-
360spinhouston.com
-
joshandmarla.info
-
ampremiumoney.xyz
-
mq1888.net
-
shogunmarketing.net
-
emis-multicaixa.net
-
mahorat.com
-
bidnpack.com
-
spacesforhumanity.com
-
invest-project.xyz
-
bitcoin600.com
-
recall-research.com
-
immotalocvoices.com
-
ntyh.xyz
-
mindreadingrobots.com
-
dfgsy.xyz
-
valutoman.website
-
cureandpuriscientific.com
-
lauderdalehomesandland.com
-
tcbk.space
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11307.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11307.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ybCORB.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ybCORB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4B3.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11307.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11307.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11307.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11307.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp4B3.tmp
memory/2064-144-0x0000000005C90000-0x0000000005CF6000-memory.dmp
memory/2064-150-0x00000000068B0000-0x00000000068CE000-memory.dmp
memory/2064-157-0x0000000007930000-0x0000000007938000-memory.dmp
memory/2064-156-0x0000000007950000-0x000000000796A000-memory.dmp
memory/2064-154-0x0000000007890000-0x0000000007926000-memory.dmp
memory/2064-137-0x00000000029F0000-0x0000000002A26000-memory.dmp
memory/2064-153-0x0000000007680000-0x000000000768A000-memory.dmp
memory/2064-139-0x00000000055F0000-0x0000000005C18000-memory.dmp
memory/2064-152-0x0000000007610000-0x000000000762A000-memory.dmp
memory/2064-151-0x0000000007C50000-0x00000000082CA000-memory.dmp
memory/2064-145-0x0000000005D00000-0x0000000005D66000-memory.dmp
memory/2064-143-0x0000000005460000-0x0000000005482000-memory.dmp
memory/2064-155-0x0000000007840000-0x000000000784E000-memory.dmp
memory/2064-149-0x0000000071610000-0x000000007165C000-memory.dmp
memory/2064-148-0x00000000068D0000-0x0000000006902000-memory.dmp
memory/2064-147-0x0000000006330000-0x000000000634E000-memory.dmp
memory/2584-132-0x0000000005290000-0x0000000005322000-memory.dmp
memory/2584-131-0x00000000057A0000-0x0000000005D44000-memory.dmp
memory/2584-130-0x0000000000910000-0x0000000000990000-memory.dmp
memory/2584-134-0x0000000008E30000-0x0000000008ECC000-memory.dmp
memory/2584-133-0x0000000005230000-0x000000000523A000-memory.dmp
memory/4852-146-0x0000000000F20000-0x000000000126A000-memory.dmp
memory/4852-142-0x0000000000400000-0x000000000042F000-memory.dmp