Analysis
- max time kernel
151s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
14/11/2022, 10:43
General
- Target DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe
- Size 606KB
- Sample221114-mr866agg69
- SHA256 93e9e99eb9d74a0cfa3cec7fea4a663b9ad5e8fe4e6ba38bf597a902ce592e1e
Malware Config
Extracted
-
formbook
-
4.1
-
t36t
-
klinkspremiumwildlife.com
-
teto-store.com
-
minneapolistaxattorney.net
-
zgomc7.com
-
invest-nj.xyz
-
uinnou.com
-
addtr.online
-
hollydays.online
-
fearurself.com
-
balaaconstruction.com
-
myyacht.rentals
-
hstonme.xyz
-
51junt.com
-
sidagj.com
-
weelilfellas.com
-
mroadholdings.com
-
torontomillwork.com
-
gonks.shop
-
jupefeeds.online
-
drpmb.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 47 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xvLhFUOdFA.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xvLhFUOdFA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9971.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp9971.tmp
memory/2396-156-0x0000000007090000-0x00000000070AA000-memory.dmp
memory/2396-157-0x0000000007100000-0x000000000710A000-memory.dmp
memory/2396-152-0x0000000006360000-0x0000000006392000-memory.dmp
memory/2396-158-0x0000000007310000-0x00000000073A6000-memory.dmp
memory/2396-139-0x0000000002460000-0x0000000002496000-memory.dmp
memory/2396-166-0x00000000073B0000-0x00000000073B8000-memory.dmp
memory/2396-165-0x00000000073D0000-0x00000000073EA000-memory.dmp
memory/2396-164-0x00000000072C0000-0x00000000072CE000-memory.dmp
memory/2396-144-0x0000000004EC0000-0x0000000004EE2000-memory.dmp
memory/2396-142-0x0000000004F10000-0x0000000005538000-memory.dmp
memory/2396-145-0x00000000056E0000-0x0000000005746000-memory.dmp
memory/2396-146-0x0000000005750000-0x00000000057B6000-memory.dmp
memory/2396-148-0x0000000005D80000-0x0000000005D9E000-memory.dmp
memory/2396-155-0x00000000076D0000-0x0000000007D4A000-memory.dmp
memory/2396-154-0x0000000006340000-0x000000000635E000-memory.dmp
memory/2396-153-0x0000000071B50000-0x0000000071B9C000-memory.dmp
memory/2948-172-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/2948-181-0x0000000002830000-0x0000000002840000-memory.dmp
memory/2948-174-0x0000000002920000-0x0000000002930000-memory.dmp
memory/2948-171-0x0000000007E50000-0x0000000007F51000-memory.dmp
memory/2948-175-0x0000000002920000-0x0000000002930000-memory.dmp
memory/2948-176-0x0000000002920000-0x0000000002930000-memory.dmp
memory/2948-184-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/2948-183-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/2948-169-0x0000000007E50000-0x0000000007F51000-memory.dmp
memory/2948-151-0x0000000007CE0000-0x0000000007E44000-memory.dmp
memory/2948-182-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/2948-173-0x0000000002920000-0x0000000002930000-memory.dmp
memory/2948-180-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/2948-179-0x00000000027E0000-0x00000000027F0000-memory.dmp
memory/2948-178-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/2948-177-0x0000000002920000-0x0000000002930000-memory.dmp
memory/3496-160-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3496-143-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3496-149-0x0000000001AF0000-0x0000000001E3A000-memory.dmp
memory/3496-150-0x0000000001AA0000-0x0000000001AB4000-memory.dmp
memory/3584-161-0x0000000000BE0000-0x0000000000BEA000-memory.dmp
memory/3584-170-0x0000000000380000-0x00000000003AF000-memory.dmp
memory/3584-168-0x0000000000BF0000-0x0000000000C83000-memory.dmp
memory/3584-167-0x0000000000DB0000-0x00000000010FA000-memory.dmp
memory/3584-162-0x0000000000380000-0x00000000003AF000-memory.dmp
memory/4904-132-0x0000000000820000-0x00000000008BE000-memory.dmp
memory/4904-133-0x0000000005790000-0x0000000005D34000-memory.dmp
memory/4904-134-0x0000000005280000-0x0000000005312000-memory.dmp
memory/4904-135-0x0000000005260000-0x000000000526A000-memory.dmp
memory/4904-136-0x0000000008B60000-0x0000000008BFC000-memory.dmp