Analysis
- max time kernel
100s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
08/11/2022, 14:59
General
- Target 2a4334476109d2ef5b95fbc6156e284a4c7340ffad00def833b23a3488884ded.exe
- Size 541KB
- Sample221108-scrlfsefdk
- SHA256 2a4334476109d2ef5b95fbc6156e284a4c7340ffad00def833b23a3488884ded
Malware Config
Extracted
-
formbook
-
4.1
-
pf20
-
coldprobe.repair
-
onlinehealthcare.biz
-
grandpasstore.com
-
osakav.online
-
speakeraudit.com
-
halltownrealestate.com
-
pyrobox.pro
-
lyonem.one
-
0519jx.net
-
plumpmail.com
-
zauna.xyz
-
villeos.net
-
zhijiew.com
-
ek7u8y1jr.com
-
bayuscool.com
-
markerpoint.online
-
around.cash
-
diarpohody.online
-
mercymobilecanning.com
-
sanjuanalfuturo.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a4334476109d2ef5b95fbc6156e284a4c7340ffad00def833b23a3488884ded.exe"C:\Users\Admin\AppData\Local\Temp\2a4334476109d2ef5b95fbc6156e284a4c7340ffad00def833b23a3488884ded.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2a4334476109d2ef5b95fbc6156e284a4c7340ffad00def833b23a3488884ded.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2a4334476109d2ef5b95fbc6156e284a4c7340ffad00def833b23a3488884ded.exe"C:\Users\Admin\AppData\Local\Temp\2a4334476109d2ef5b95fbc6156e284a4c7340ffad00def833b23a3488884ded.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2348-141-0x00000000014D0000-0x000000000181A000-memory.dmp
memory/2348-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3656-144-0x0000000005550000-0x00000000055B6000-memory.dmp
memory/3656-151-0x0000000007150000-0x000000000715A000-memory.dmp
memory/3656-137-0x00000000047B0000-0x00000000047E6000-memory.dmp
memory/3656-155-0x0000000007400000-0x0000000007408000-memory.dmp
memory/3656-154-0x0000000007420000-0x000000000743A000-memory.dmp
memory/3656-140-0x0000000004E20000-0x0000000005448000-memory.dmp
memory/3656-153-0x0000000007310000-0x000000000731E000-memory.dmp
memory/3656-142-0x0000000004C70000-0x0000000004C92000-memory.dmp
memory/3656-143-0x0000000004D10000-0x0000000004D76000-memory.dmp
memory/3656-152-0x0000000007350000-0x00000000073E6000-memory.dmp
memory/3656-145-0x0000000005DC0000-0x0000000005DDE000-memory.dmp
memory/3656-146-0x0000000006390000-0x00000000063C2000-memory.dmp
memory/3656-147-0x00000000707D0000-0x000000007081C000-memory.dmp
memory/3656-148-0x0000000006370000-0x000000000638E000-memory.dmp
memory/3656-149-0x0000000007720000-0x0000000007D9A000-memory.dmp
memory/3656-150-0x00000000070E0000-0x00000000070FA000-memory.dmp
memory/4908-132-0x0000000000590000-0x000000000061E000-memory.dmp
memory/4908-133-0x0000000005630000-0x0000000005BD4000-memory.dmp
memory/4908-134-0x0000000005180000-0x0000000005212000-memory.dmp
memory/4908-135-0x0000000005BE0000-0x0000000005C7C000-memory.dmp