Analysis
- max time kernel
147s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
19/08/2022, 11:53
General
- Target Wzrjskmgznwisyoxwnmxqortstqhfdnnon.exe
- Size 665KB
- Sample220819-n2aa9affe2
- SHA256 aabc8f775c58a95c36f370039a5ba9d30f6bf981c665d58bb32babe9368a22e3
Malware Config
Extracted
-
formbook
-
4.1
-
ok27
-
stagcasm.com
-
harryherbst.com
-
globalbaike.com
-
profitcryptosignals.space
-
xxxxgalactic.com
-
amazingearth.one
-
inaurahome.co.uk
-
broadscopefp.co.uk
-
wbeauty.co.uk
-
kingsweetener.com
-
plentinainvest.com
-
cruises-64228.com
-
montipiozzsx-abc.one
-
adolphobia.com
-
sarahforrest.com
-
probateconsultant.com
-
boardmoors.com
-
nomornots.com
-
hailanghua88.com
-
blackhatwizardd.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Formbook payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wzrjskmgznwisyoxwnmxqortstqhfdnnon.exe"C:\Users\Admin\AppData\Local\Temp\Wzrjskmgznwisyoxwnmxqortstqhfdnnon.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/744-265-0x0000000050410000-0x000000005043F000-memory.dmp
memory/744-261-0x0000000001700000-0x0000000001A4A000-memory.dmp
memory/744-262-0x0000000001600000-0x0000000001614000-memory.dmp
memory/924-270-0x0000000002B50000-0x0000000002BE3000-memory.dmp
memory/924-268-0x0000000000E10000-0x0000000000E3F000-memory.dmp
memory/924-272-0x0000000000E10000-0x0000000000E3F000-memory.dmp
memory/924-269-0x0000000002CB0000-0x0000000002FFA000-memory.dmp
memory/924-267-0x00000000009C0000-0x00000000009D9000-memory.dmp
memory/2740-263-0x0000000003660000-0x0000000003773000-memory.dmp
memory/2740-271-0x00000000032B0000-0x00000000033AE000-memory.dmp
memory/2740-273-0x00000000032B0000-0x00000000033AE000-memory.dmp
memory/2956-221-0x0000000050410000-0x000000005043F000-memory.dmp