Analysis
- max time kernel
91s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
08/11/2022, 19:58
General
- Target SecuriteInfo.com.IL.Trojan.MSILZilla.23856.25548.25480.exe
- Size 2.3MB
- Sample221108-yps8psefg8
- SHA256 b30ff09cd639b2029019e4328bad876c683c25ae2a4d4dd0abea67ea8d759e1f
Malware Config
Extracted
-
formbook
-
fbce
-
Z4SlvN7wcIB/2gY=
-
FFxoAMtxrL9l7g==
-
mKvH23KL1Kkslrophi2XdTixtw==
-
ts/+Gjx4QSxh2v/2bgWSdTixtw==
-
1+wJH6lV4UJyjr7vbBg=
-
yR65207vjV/6Q6UHbA==
-
Y2Wer9IX36etHIQvahE=
-
m6bDwG4ZqmXdJmxfulNdSORn
-
9JCvDS+6rL9l7g==
-
h8BVhgCWF42kNWJ0kEEG
-
E4cgTU/1Dd/vUGxctFFdSORn
-
Sas/mUy2gu3J6w==
-
gXrJPNkWYT9+yAM0LxuSOA==
-
uwi39xAk3ausGIQvahE=
-
L9UlTdkVJI0sKFML
-
FRFTqk6M/uOMHTt+s4xkLw==
-
frH5Cqk6Ze7X7GBvzGRsUIa7/nAbM3l4+Q==
-
Woez0ZwtpgHbKUQrZUwMgDI=
-
ODtHQ3o5PY0sKFML
-
lrHa5P2LmHI5d5QRLxuSOA==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.23856.25548.25480.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.23856.25548.25480.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAzAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.23856.25548.25480.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.23856.25548.25480.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4204-138-0x00000000062A0000-0x0000000006306000-memory.dmp
memory/4204-139-0x00000000068D0000-0x00000000068EE000-memory.dmp
memory/4204-135-0x0000000002F90000-0x0000000002FC6000-memory.dmp
memory/4204-136-0x0000000005BC0000-0x00000000061E8000-memory.dmp
memory/4204-137-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/4204-140-0x0000000007F50000-0x00000000085CA000-memory.dmp
memory/4204-141-0x0000000006D60000-0x0000000006D7A000-memory.dmp
memory/4444-143-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4444-145-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4444-146-0x0000000000401000-0x000000000042E000-memory.dmp
memory/4444-147-0x0000000001770000-0x0000000001ABA000-memory.dmp
memory/4996-132-0x0000000000710000-0x000000000095C000-memory.dmp
memory/4996-133-0x0000000005630000-0x0000000005652000-memory.dmp