Analysis
- max time kernel
147s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
25/10/2022, 10:46
General
- Target Banka odeme havalesi bilgileri TL9850900 25102022.exe
- Size 604KB
- Sample221025-mtz19scdaq
- SHA256 e8db90d8d2528f0767e5b82262223e07578e29f8e4166df3cf495318006ebbd6
Malware Config
Extracted
-
formbook
-
4.1
-
jr22
-
941zhe.com
-
lunarportal.space
-
xn--osmaniyeiek-t9ab.online
-
trejoscar.com
-
nrnursery.com
-
quizcannot.cfd
-
seedstockersthailand.com
-
watsonwindow.com
-
wjfholdings.com
-
weziclondon.com
-
naruot.xyz
-
yeji.plus
-
classicmenstore.com
-
oharatravel.com
-
therapyplankits.com
-
keviegreshonpt.com
-
qdlyner.com
-
seithupaarungal.com
-
casinorates.online
-
8ug4as.icu
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Banka odeme havalesi bilgileri TL9850900 25102022.exe"C:\Users\Admin\AppData\Local\Temp\Banka odeme havalesi bilgileri TL9850900 25102022.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Banka odeme havalesi bilgileri TL9850900 25102022.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Banka odeme havalesi bilgileri TL9850900 25102022.exe"C:\Users\Admin\AppData\Local\Temp\Banka odeme havalesi bilgileri TL9850900 25102022.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Banka odeme havalesi bilgileri TL9850900 25102022.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2196-133-0x0000000007440000-0x00000000074D2000-memory.dmp
memory/2196-134-0x0000000007D70000-0x0000000007E0C000-memory.dmp
memory/2196-132-0x0000000000290000-0x000000000032C000-memory.dmp
memory/2648-146-0x00000000030F0000-0x0000000003200000-memory.dmp
memory/2648-167-0x00000000086B0000-0x00000000087BF000-memory.dmp
memory/2648-166-0x00000000086B0000-0x00000000087BF000-memory.dmp
memory/3104-149-0x0000000071C80000-0x0000000071CCC000-memory.dmp
memory/3104-153-0x0000000007570000-0x000000000757A000-memory.dmp
memory/3104-141-0x0000000005B30000-0x0000000005B96000-memory.dmp
memory/3104-142-0x0000000005BA0000-0x0000000005C06000-memory.dmp
memory/3104-163-0x0000000007820000-0x0000000007828000-memory.dmp
memory/3104-139-0x0000000005350000-0x0000000005978000-memory.dmp
memory/3104-147-0x00000000061F0000-0x000000000620E000-memory.dmp
memory/3104-148-0x00000000073B0000-0x00000000073E2000-memory.dmp
memory/3104-138-0x0000000004C40000-0x0000000004C76000-memory.dmp
memory/3104-150-0x00000000067B0000-0x00000000067CE000-memory.dmp
memory/3104-151-0x0000000007B50000-0x00000000081CA000-memory.dmp
memory/3104-152-0x0000000007500000-0x000000000751A000-memory.dmp
memory/3104-140-0x0000000005240000-0x0000000005262000-memory.dmp
memory/3104-162-0x0000000007840000-0x000000000785A000-memory.dmp
memory/3104-156-0x0000000007780000-0x0000000007816000-memory.dmp
memory/3104-161-0x0000000007730000-0x000000000773E000-memory.dmp
memory/4252-157-0x0000000000ED0000-0x0000000000EF7000-memory.dmp
memory/4252-158-0x0000000002970000-0x0000000002CBA000-memory.dmp
memory/4252-160-0x0000000000920000-0x000000000094F000-memory.dmp
memory/4252-164-0x0000000002890000-0x0000000002923000-memory.dmp
memory/4252-165-0x0000000000920000-0x000000000094F000-memory.dmp
memory/4436-137-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4436-155-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4436-145-0x0000000000E30000-0x0000000000E44000-memory.dmp
memory/4436-144-0x0000000001340000-0x000000000168A000-memory.dmp