Analysis
- max time kernel
152s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
09/11/2022, 21:42
General
- Target file.exe
- Size 732KB
- Sample221109-1kc22acdb9
- SHA256 487d5cc1fe3bdf52fc4f8aa6207e6e63af056428fb80cbdd33fc6e0a6042712f
Malware Config
Extracted
-
formbook
-
pgnt
-
0WG18LbM4lR9iqMRa4nlBzTb
-
jcfGYzPgZTqFZVO9FV2yIw==
-
laIfrdSC8/4CNg==
-
Q73ilev5GIWuOrAAFV2yIw==
-
Q2u/pMw7pv4sPA==
-
TbqvIUHwlQscPo0HFV2yIw==
-
8PNWfGPyE8n0IQ==
-
WtgROxXzvY2L
-
PryaRBNjm4eP
-
Y9Hdi06Cry1um9Sj68YAu1o=
-
3Gulyp7CMQtR78jvLkk=
-
JJ3GasTVTCRQT6Tfz6S6GlI=
-
RnS42bhb9tI0R6UpD6wOxriNxw==
-
he1mi2sOGfzTRGHnuA==
-
eaYjCtjxVjdU5XLRtBMBLKk9quA=
-
k9rTeEqYzzw8WaTfz6S6GlI=
-
5luVQwe2vJWKEAiMdF4=
-
MGW14L9OVk5Y5TaR6w/DqdhYxXVY
-
mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==
-
y5klhuMbE8n0IQ==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BkjmGZfUUuVY.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BkjmGZfUUuVY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9EC0.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp9EC0.tmp
memory/2168-154-0x0000000001370000-0x0000000001380000-memory.dmp
memory/2168-146-0x0000000000401000-0x000000000042F000-memory.dmp
memory/2168-162-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2168-163-0x0000000000401000-0x000000000042F000-memory.dmp
memory/2168-153-0x0000000000422000-0x0000000000424000-memory.dmp
memory/2168-152-0x00000000017D0000-0x0000000001B1A000-memory.dmp
memory/2168-143-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2168-145-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2492-175-0x0000000008560000-0x0000000008652000-memory.dmp
memory/2492-173-0x0000000008560000-0x0000000008652000-memory.dmp
memory/2492-155-0x0000000002EA0000-0x0000000002F56000-memory.dmp
memory/2968-166-0x0000000000340000-0x000000000036D000-memory.dmp
memory/2968-174-0x0000000000340000-0x000000000036D000-memory.dmp
memory/2968-168-0x0000000002620000-0x000000000296A000-memory.dmp
memory/2968-165-0x0000000000D00000-0x0000000000D14000-memory.dmp
memory/2968-172-0x0000000002410000-0x000000000249F000-memory.dmp
memory/3044-158-0x0000000006B40000-0x0000000006B5E000-memory.dmp
memory/3044-147-0x0000000005600000-0x0000000005622000-memory.dmp
memory/3044-171-0x0000000007BD0000-0x0000000007BD8000-memory.dmp
memory/3044-156-0x0000000006B60000-0x0000000006B92000-memory.dmp
memory/3044-139-0x0000000002CC0000-0x0000000002CF6000-memory.dmp
memory/3044-170-0x0000000007BF0000-0x0000000007C0A000-memory.dmp
memory/3044-159-0x0000000007EF0000-0x000000000856A000-memory.dmp
memory/3044-160-0x00000000078B0000-0x00000000078CA000-memory.dmp
memory/3044-151-0x00000000065B0000-0x00000000065CE000-memory.dmp
memory/3044-141-0x0000000005730000-0x0000000005D58000-memory.dmp
memory/3044-164-0x0000000007920000-0x000000000792A000-memory.dmp
memory/3044-149-0x0000000005FB0000-0x0000000006016000-memory.dmp
memory/3044-157-0x00000000715B0000-0x00000000715FC000-memory.dmp
memory/3044-167-0x0000000007B30000-0x0000000007BC6000-memory.dmp
memory/3044-148-0x0000000005ED0000-0x0000000005F36000-memory.dmp
memory/3044-169-0x0000000007AE0000-0x0000000007AEE000-memory.dmp
memory/3648-134-0x0000000004CA0000-0x0000000004D32000-memory.dmp
memory/3648-132-0x00000000001D0000-0x000000000028E000-memory.dmp
memory/3648-136-0x0000000005A90000-0x0000000005B2C000-memory.dmp
memory/3648-133-0x0000000005250000-0x00000000057F4000-memory.dmp
memory/3648-135-0x0000000004C40000-0x0000000004C4A000-memory.dmp