Analysis
- max time kernel
90s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
04/10/2022, 09:14
General
- Target SecuriteInfo.com.Win32.PWSX-gen.15814.13814.exe
- Size 1.2MB
- Sample221004-k7a8ysadd5
- SHA256 fe084e5fcd96061325aafd4528aedf59f3385a5c1bbf9daf3337ba1cabf4488f
Malware Config
Extracted
-
formbook
-
fofg
-
FHyydxpFBs0S8b4ZlP7ZEtd/
-
EVaCEKb/cVV9xQ==
-
U9I5lke0IuU7vj5EXus=
-
rXD3AKPV3qUblOUsV41KMfU=
-
PwBSy5z56XNzIvnS3ygsKv0=
-
CQe1BLbSnGXX
-
HuhKjxhLhxqBy2FFz8WoFA==
-
QJymezEoLOFZ1T5EXus=
-
V8r5PAdwuGK2AUARohas
-
b1XV06ANH9s5uj5EXus=
-
3EiEhwo7Euw2tl8=
-
c2PjK8Izkydy5N8x
-
CXCkYf0m/qPrv8QajKyT6Oo=
-
pHjy+Mk0CqvWBXdCz8WoFA==
-
QjSwr3/j5rAyvz5EXus=
-
+edxANg/sU+k8YFQz8WoFA==
-
tWiQq3rqyl6cTAG9pA==
-
GeAyMQxBUOlDwD5EXus=
-
nQ5eoT2mEKkhDN2DwBek
-
JP5dIbHlrXXR8umDwBek
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15814.13814.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15814.13814.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QaGACHm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QaGACHm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8E07.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15814.13814.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15814.13814.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15814.13814.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15814.13814.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp8E07.tmp
memory/396-153-0x0000000007BE0000-0x000000000825A000-memory.dmp
memory/396-157-0x00000000077D0000-0x00000000077DE000-memory.dmp
memory/396-159-0x00000000078C0000-0x00000000078C8000-memory.dmp
memory/396-158-0x00000000078E0000-0x00000000078FA000-memory.dmp
memory/396-146-0x00000000054C0000-0x00000000054E2000-memory.dmp
memory/396-156-0x0000000007820000-0x00000000078B6000-memory.dmp
memory/396-140-0x0000000002950000-0x0000000002986000-memory.dmp
memory/396-155-0x0000000007610000-0x000000000761A000-memory.dmp
memory/396-142-0x0000000005510000-0x0000000005B38000-memory.dmp
memory/396-154-0x00000000075A0000-0x00000000075BA000-memory.dmp
memory/396-147-0x0000000005BB0000-0x0000000005C16000-memory.dmp
memory/396-152-0x0000000006840000-0x000000000685E000-memory.dmp
memory/396-151-0x0000000071880000-0x00000000718CC000-memory.dmp
memory/396-150-0x0000000007260000-0x0000000007292000-memory.dmp
memory/396-149-0x00000000062A0000-0x00000000062BE000-memory.dmp
memory/1568-148-0x00000000011E0000-0x000000000152A000-memory.dmp
memory/1568-145-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1760-134-0x00000000051C0000-0x0000000005252000-memory.dmp
memory/1760-132-0x00000000006C0000-0x0000000000802000-memory.dmp
memory/1760-133-0x00000000056D0000-0x0000000005C74000-memory.dmp
memory/1760-137-0x0000000009120000-0x0000000009186000-memory.dmp
memory/1760-136-0x0000000008E80000-0x0000000008F1C000-memory.dmp
memory/1760-135-0x00000000051A0000-0x00000000051AA000-memory.dmp