Analysis
- max time kernel
150s - max time network
155s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
14/11/2022, 10:43
General
- Target DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe
- Size 606KB
- Sample221114-mr866agg69
- SHA256 93e9e99eb9d74a0cfa3cec7fea4a663b9ad5e8fe4e6ba38bf597a902ce592e1e
Malware Config
Extracted
-
formbook
-
4.1
-
t36t
-
klinkspremiumwildlife.com
-
teto-store.com
-
minneapolistaxattorney.net
-
zgomc7.com
-
invest-nj.xyz
-
uinnou.com
-
addtr.online
-
hollydays.online
-
fearurself.com
-
balaaconstruction.com
-
myyacht.rentals
-
hstonme.xyz
-
51junt.com
-
sidagj.com
-
weelilfellas.com
-
mroadholdings.com
-
torontomillwork.com
-
gonks.shop
-
jupefeeds.online
-
drpmb.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 6 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xvLhFUOdFA.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xvLhFUOdFA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAC18.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmpAC18.tmp
memory/816-87-0x0000000000070000-0x000000000009F000-memory.dmp
memory/816-84-0x0000000000640000-0x00000000006D3000-memory.dmp
memory/816-83-0x0000000000070000-0x000000000009F000-memory.dmp
memory/816-82-0x0000000002240000-0x0000000002543000-memory.dmp
memory/816-81-0x0000000000480000-0x00000000004A6000-memory.dmp
memory/944-70-0x0000000074840000-0x0000000074DEB000-memory.dmp
memory/944-74-0x0000000074840000-0x0000000074DEB000-memory.dmp
memory/1356-73-0x0000000003E80000-0x0000000003F77000-memory.dmp
memory/1356-77-0x0000000006130000-0x00000000062AE000-memory.dmp
memory/1356-86-0x0000000006130000-0x00000000062AE000-memory.dmp
memory/1356-88-0x0000000005F60000-0x0000000006087000-memory.dmp
memory/1356-85-0x0000000005F60000-0x0000000006087000-memory.dmp
memory/1364-71-0x0000000000BB0000-0x0000000000EB3000-memory.dmp
memory/1364-67-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1364-64-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1364-75-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1364-76-0x0000000000770000-0x0000000000784000-memory.dmp
memory/1364-72-0x00000000003C0000-0x00000000003D4000-memory.dmp
memory/1364-79-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1364-65-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1752-54-0x0000000000860000-0x00000000008FE000-memory.dmp
memory/1752-57-0x0000000000500000-0x000000000050C000-memory.dmp
memory/1752-58-0x0000000007EB0000-0x0000000007F2E000-memory.dmp
memory/1752-56-0x0000000000520000-0x0000000000538000-memory.dmp
memory/1752-55-0x0000000076681000-0x0000000076683000-memory.dmp
memory/1752-63-0x0000000004B20000-0x0000000004B64000-memory.dmp