Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
10/10/2022, 10:37
General
- Target RFQ PBMS 401055-STR-22.pdf.exe
- Size 1.0MB
- Sample221010-mns1rsbfem
- SHA256 93e11bd9c359b03f6d2a3add3d1a109275eaadc5b9875b395f9d87e302db93dd
Malware Config
Extracted
-
nworm
-
v0.3.8
-
svetanakravenova247.ddns.net:3498
-
37f24ea7
Extracted
-
formbook
-
mmtr
-
A2DZqKcj5ytLVZtHJA==
-
fMXPWQG+JWa0S6lZOg==
-
8kymMDxB6ShVJHxu2gshFtXY9Rw=
-
1TcOF6WxcdzplqFGcUCNkBY=
-
k3TLhZ+bOG7ahplcPA==
-
K4kL5Aq5abHNS6lZOg==
-
mXDSo9XmxlqYN6psOA==
-
m+RNCVT4shAb
-
G1kzROn+2jCug7F5psQ=
-
qNYsJkWzqwkZ
-
0BcDQuH0xt4oBh4=
-
pfRW4ZhmRsEiyvP2Mg==
-
Sqgj4eztyCg0Ezwo39iHXQ==
-
bIi2etJbcdUB
-
k2g3gBesND9hUoKOzGaVFKX6IuUaknqH1Q==
-
8dFDXQPnb4s+sWfhwoqOdgmABBK+YGg=
-
Pn9PmDzelx84EjfdzY0WkiRPz6i4
-
SrUfvOfNO3DMdLvB
-
GFXHQ9NuPdHsxOiU2umGMSiTvQE=
-
Kv9sdrhSbDfMdLvB
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
- Executes dropped EXE 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ PBMS 401055-STR-22.pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ PBMS 401055-STR-22.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ PBMS 401055-STR-22.pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ PBMS 401055-STR-22.pdf.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp3208.tmpQ2Dmo8cwUrb1GWZ.exe"C:\Users\Admin\AppData\Local\Temp\tmp3208.tmpQ2Dmo8cwUrb1GWZ.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp3208.tmpQ2Dmo8cwUrb1GWZ.exe"C:\Users\Admin\AppData\Local\Temp\tmp3208.tmpQ2Dmo8cwUrb1GWZ.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
RFQ PBMS 401055-STR-22.pdf.exe.log
tmp3208.tmpQ2Dmo8cwUrb1GWZ.exe
tmp3208.tmpQ2Dmo8cwUrb1GWZ.exe
tmp3208.tmpQ2Dmo8cwUrb1GWZ.exe
memory/368-133-0x0000000005F20000-0x00000000064C4000-memory.dmp
memory/368-134-0x0000000005890000-0x0000000005922000-memory.dmp
memory/368-135-0x0000000005820000-0x000000000582A000-memory.dmp
memory/368-136-0x000000000A400000-0x000000000A49C000-memory.dmp
memory/368-137-0x000000000A4A0000-0x000000000A506000-memory.dmp
memory/368-132-0x0000000000D80000-0x0000000000E86000-memory.dmp
memory/1068-162-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1068-165-0x00000000007F0000-0x0000000000800000-memory.dmp
memory/1068-164-0x0000000001170000-0x00000000014BA000-memory.dmp
memory/1068-163-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1068-161-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1068-158-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1144-168-0x00000000007E0000-0x00000000007F2000-memory.dmp
memory/1144-169-0x00000000010D0000-0x00000000010FD000-memory.dmp
memory/1144-170-0x0000000002F70000-0x00000000032BA000-memory.dmp
memory/1384-141-0x0000000006FF0000-0x0000000007618000-memory.dmp
memory/1384-146-0x0000000007760000-0x0000000007782000-memory.dmp
memory/1384-152-0x0000000008860000-0x0000000008868000-memory.dmp
memory/1384-151-0x0000000008600000-0x000000000860A000-memory.dmp
memory/1384-150-0x0000000007D50000-0x0000000007D72000-memory.dmp
memory/1384-149-0x0000000007CB0000-0x0000000007D16000-memory.dmp
memory/1384-148-0x00000000078A0000-0x00000000078EA000-memory.dmp
memory/1384-147-0x0000000006FD0000-0x0000000006FEE000-memory.dmp
memory/1384-139-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1384-145-0x0000000007800000-0x0000000007896000-memory.dmp
memory/1384-142-0x0000000006F90000-0x0000000006FAA000-memory.dmp
memory/1384-144-0x0000000007DE0000-0x000000000845A000-memory.dmp
memory/1384-143-0x0000000007720000-0x0000000007756000-memory.dmp
memory/2724-166-0x0000000002D00000-0x0000000002DE6000-memory.dmp
memory/4328-156-0x0000000000470000-0x0000000000572000-memory.dmp