Analysis
- max time kernel
148s - max time network
151s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
- submitted
22/07/2022, 10:16
General
- Target TNT_e-invoice_N0.11073490.exe
- Size 574KB
- Sample220722-mas4lsedd4
- SHA256 6ecc41234c9c627fb864d3de10169477884aab6d62c199141a1b1b2da8b7ff8c
Malware Config
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TNT_e-invoice_N0.11073490.exe"C:\Users\Admin\AppData\Local\Temp\TNT_e-invoice_N0.11073490.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TNT_e-invoice_N0.11073490.exe"C:\Users\Admin\AppData\Local\Temp\TNT_e-invoice_N0.11073490.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1208-54-0x0000000000970000-0x0000000000A06000-memory.dmp
memory/1208-55-0x00000000758D1000-0x00000000758D3000-memory.dmp
memory/1208-56-0x00000000005A0000-0x00000000005BE000-memory.dmp
memory/1208-57-0x00000000005D0000-0x00000000005DA000-memory.dmp
memory/1208-58-0x00000000057C0000-0x000000000582A000-memory.dmp
memory/1208-59-0x0000000001FA0000-0x0000000001FD2000-memory.dmp
memory/1336-68-0x0000000000430000-0x0000000000441000-memory.dmp
memory/1336-61-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1336-63-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1336-66-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1336-67-0x0000000000A10000-0x0000000000D13000-memory.dmp
memory/1336-60-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1336-74-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1336-71-0x0000000000470000-0x0000000000481000-memory.dmp
memory/1380-72-0x0000000007270000-0x00000000073F9000-memory.dmp
memory/1380-69-0x0000000006B20000-0x0000000006C35000-memory.dmp
memory/1380-79-0x0000000008F60000-0x00000000090A3000-memory.dmp
memory/1380-81-0x0000000008F60000-0x00000000090A3000-memory.dmp
memory/1488-75-0x0000000000C40000-0x0000000000C4D000-memory.dmp
memory/1488-76-0x0000000000080000-0x00000000000AD000-memory.dmp
memory/1488-77-0x0000000002050000-0x0000000002353000-memory.dmp
memory/1488-78-0x00000000009C0000-0x0000000000A50000-memory.dmp
memory/1488-80-0x0000000000080000-0x00000000000AD000-memory.dmp