Analysis
- max time kernel
151s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
18/11/2022, 22:49
General
- Target d815c20f87e50b43e941bcdc45b158e5.exe
- Size 374KB
- Sample221118-2rnyjsfe4t
- SHA256 b757c82d494f1f23816a87fc609e8f5227fbe921aa80c5fcddd95fde653c8523
Malware Config
Extracted
-
formbook
-
henz
-
IxWMb+jVsoinShuZJzk=
-
TPfKgQZ//oGnKr/J
-
EsK0WxD5kY65XOW1Td/5CxSUpCUytR7M
-
KebSmiCP9p8yUw==
-
HAt/ljkEuqMLHOLCi53Pv8MKX9qk
-
CY4ogZTwJc4vSw==
-
WWDIx5UYUDyepntE0YIAPca3/rI=
-
+Pkr01Lfb2rME7bL
-
S5nyK0p8jS2xdwQ=
-
W/oqvlO57LfkLcLHnQ==
-
zrrwtqkTLwxulm4l8FGopw==
-
AqucYext8bzFbOKthIm8E6gfVkUHxKY=
-
OfnjeDs78+RTcz4OHRl+
-
XKf1wwpZR5hLLjHgmUGOpQ==
-
JMyhSLoJPTCwn5o9zX2d8i1+
-
Wk54MBsDhWSVbnIRkQ==
-
7aaYR/tOhh9piTw5/KHSRwuK2iqgafw7pQ==
-
hH/EYxN+jC2xdwQ=
-
S0F4ORqDjS2xdwQ=
-
0o/UwXnuJ+sJp0cOHRl+
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Executes dropped EXE 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 9 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d815c20f87e50b43e941bcdc45b158e5.exe"C:\Users\Admin\AppData\Local\Temp\d815c20f87e50b43e941bcdc45b158e5.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ifzaocyiid.exe"C:\Users\Admin\AppData\Local\Temp\ifzaocyiid.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ifzaocyiid.exe"C:\Users\Admin\AppData\Local\Temp\ifzaocyiid.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
folsh.i
ifzaocyiid.exe
ifzaocyiid.exe
ifzaocyiid.exe
quocykgcgjy.ntm
memory/216-144-0x00000000012A0000-0x00000000012B0000-memory.dmp
memory/216-147-0x0000000000400000-0x000000000042F000-memory.dmp
memory/216-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/216-140-0x0000000000401000-0x000000000042F000-memory.dmp
memory/216-141-0x00000000012E0000-0x000000000162A000-memory.dmp
memory/216-142-0x0000000000E70000-0x0000000000E80000-memory.dmp
memory/216-148-0x0000000000401000-0x000000000042F000-memory.dmp
memory/2596-145-0x0000000008FD0000-0x00000000090F3000-memory.dmp
memory/2596-143-0x0000000008D90000-0x0000000008EFE000-memory.dmp
memory/2596-154-0x00000000091B0000-0x000000000932F000-memory.dmp
memory/2596-155-0x00000000091B0000-0x000000000932F000-memory.dmp
memory/3772-149-0x0000000000C40000-0x0000000000C4A000-memory.dmp
memory/3772-150-0x0000000000A50000-0x0000000000A7D000-memory.dmp
memory/3772-151-0x0000000001200000-0x000000000154A000-memory.dmp
memory/3772-152-0x0000000000A50000-0x0000000000A7D000-memory.dmp
memory/3772-153-0x0000000001020000-0x00000000010AF000-memory.dmp