Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
14/11/2022, 08:11
General
- Target DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe
- Size 606KB
- Sample221114-j29c5afg52
- SHA256 93e9e99eb9d74a0cfa3cec7fea4a663b9ad5e8fe4e6ba38bf597a902ce592e1e
Malware Config
Extracted
-
formbook
-
4.1
-
t36t
-
klinkspremiumwildlife.com
-
teto-store.com
-
minneapolistaxattorney.net
-
zgomc7.com
-
invest-nj.xyz
-
uinnou.com
-
addtr.online
-
hollydays.online
-
fearurself.com
-
balaaconstruction.com
-
myyacht.rentals
-
hstonme.xyz
-
51junt.com
-
sidagj.com
-
weelilfellas.com
-
mroadholdings.com
-
torontomillwork.com
-
gonks.shop
-
jupefeeds.online
-
drpmb.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 49 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xvLhFUOdFA.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xvLhFUOdFA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64E4.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp64E4.tmp
memory/2180-171-0x0000000003180000-0x000000000327A000-memory.dmp
memory/2180-151-0x0000000008380000-0x000000000850C000-memory.dmp
memory/2180-169-0x0000000003180000-0x000000000327A000-memory.dmp
memory/3152-168-0x00000000010A0000-0x0000000001133000-memory.dmp
memory/3152-163-0x0000000001300000-0x000000000164A000-memory.dmp
memory/3152-162-0x0000000000CC0000-0x0000000000D9C000-memory.dmp
memory/3152-164-0x0000000000150000-0x000000000017F000-memory.dmp
memory/3152-170-0x0000000000150000-0x000000000017F000-memory.dmp
memory/3488-149-0x0000000000E50000-0x000000000119A000-memory.dmp
memory/3488-142-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3488-159-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3488-150-0x0000000000DE0000-0x0000000000DF4000-memory.dmp
memory/3720-143-0x0000000004AC0000-0x00000000050E8000-memory.dmp
memory/3720-160-0x0000000006F50000-0x0000000006FE6000-memory.dmp
memory/3720-146-0x0000000005350000-0x00000000053B6000-memory.dmp
memory/3720-152-0x0000000005F80000-0x0000000005FB2000-memory.dmp
memory/3720-153-0x0000000071A30000-0x0000000071A7C000-memory.dmp
memory/3720-154-0x0000000005F60000-0x0000000005F7E000-memory.dmp
memory/3720-155-0x0000000007300000-0x000000000797A000-memory.dmp
memory/3720-156-0x0000000006CC0000-0x0000000006CDA000-memory.dmp
memory/3720-157-0x0000000006D40000-0x0000000006D4A000-memory.dmp
memory/3720-145-0x00000000050F0000-0x0000000005156000-memory.dmp
memory/3720-144-0x0000000004A10000-0x0000000004A32000-memory.dmp
memory/3720-148-0x00000000059C0000-0x00000000059DE000-memory.dmp
memory/3720-167-0x0000000006FF0000-0x0000000006FF8000-memory.dmp
memory/3720-139-0x0000000004410000-0x0000000004446000-memory.dmp
memory/3720-166-0x0000000007010000-0x000000000702A000-memory.dmp
memory/3720-165-0x0000000006F00000-0x0000000006F0E000-memory.dmp
memory/4856-132-0x0000000000FC0000-0x000000000105E000-memory.dmp
memory/4856-136-0x0000000009670000-0x000000000970C000-memory.dmp
memory/4856-135-0x0000000005A00000-0x0000000005A0A000-memory.dmp
memory/4856-134-0x0000000005A50000-0x0000000005AE2000-memory.dmp
memory/4856-133-0x0000000005F60000-0x0000000006504000-memory.dmp