Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 16:33

General

  • Target

    SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe

  • Size

    6KB

  • MD5

    4568108633c246c348b7a6179f1eef10

  • SHA1

    622978f85eafdd79be410d47551c0098bd924400

  • SHA256

    3f999fa0a43425869e768d6ca75c3e5a70dd34e475cdd20ee240076c6ed75749

  • SHA512

    70933c4ec2a44e4ed4d17745c19d3282094e965b2b3327f76af2810f861e51aa7f98602d1467668bf6be449d11db03ff4ce528a407b559042e7a785eae910209

  • SSDEEP

    48:6LV5MbckIQXCIsN+nK/M1DIMAGd45hJpLOj4dd2xyiXii2qBHruul4dG7FWSfbNM:RckVaNd/KoGoJa4mhiNktGGFzNt

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fs44

Decoy

whneat.com

jljcw.net

pocodelivery.com

outofplacezine.com

yavuzcansigorta.com

xinhewood-cn.com

cartogogh.com

5avis.com

joyceyong.art

digitalsurf.community

blackcreekbarns.com

magazinedistribuidor.com

sportsgross.com

drevom.online

mayibeofservice.com

gareloi-digit.com

permitha.net

renaissanceestetica.com

facts-r-friends.com

dach-loc.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.276.10448.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1004
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe purecrypter.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4972
    • C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\SysWOW64\chkdsk.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
          PID:3500

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    3
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1004-136-0x0000000000000000-mapping.dmp
    • memory/1004-137-0x0000000004C10000-0x0000000004C46000-memory.dmp
      Filesize

      216KB

    • memory/1004-138-0x0000000005280000-0x00000000058A8000-memory.dmp
      Filesize

      6.2MB

    • memory/1004-139-0x0000000005960000-0x00000000059C6000-memory.dmp
      Filesize

      408KB

    • memory/1004-140-0x0000000005B80000-0x0000000005BE6000-memory.dmp
      Filesize

      408KB

    • memory/1004-141-0x0000000006190000-0x00000000061AE000-memory.dmp
      Filesize

      120KB

    • memory/1004-142-0x00000000077C0000-0x0000000007E3A000-memory.dmp
      Filesize

      6.5MB

    • memory/1004-143-0x00000000066A0000-0x00000000066BA000-memory.dmp
      Filesize

      104KB

    • memory/1952-132-0x0000000000840000-0x0000000000848000-memory.dmp
      Filesize

      32KB

    • memory/1952-133-0x00000000070F0000-0x0000000007182000-memory.dmp
      Filesize

      584KB

    • memory/1952-134-0x0000000007740000-0x0000000007CE4000-memory.dmp
      Filesize

      5.6MB

    • memory/1952-135-0x00000000071C0000-0x00000000071E2000-memory.dmp
      Filesize

      136KB

    • memory/2756-187-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-176-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-205-0x0000000007B70000-0x0000000007B80000-memory.dmp
      Filesize

      64KB

    • memory/2756-204-0x0000000007B70000-0x0000000007B80000-memory.dmp
      Filesize

      64KB

    • memory/2756-149-0x0000000002F30000-0x0000000003091000-memory.dmp
      Filesize

      1.4MB

    • memory/2756-203-0x0000000007B70000-0x0000000007B80000-memory.dmp
      Filesize

      64KB

    • memory/2756-202-0x0000000007B70000-0x0000000007B80000-memory.dmp
      Filesize

      64KB

    • memory/2756-201-0x0000000007B70000-0x0000000007B80000-memory.dmp
      Filesize

      64KB

    • memory/2756-200-0x0000000007B70000-0x0000000007B80000-memory.dmp
      Filesize

      64KB

    • memory/2756-199-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-198-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-197-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-196-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-158-0x0000000003320000-0x0000000003415000-memory.dmp
      Filesize

      980KB

    • memory/2756-159-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-160-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-161-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-162-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-163-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-164-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-165-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-166-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-167-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-168-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-169-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-170-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-171-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-172-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-173-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-174-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-175-0x0000000003320000-0x0000000003415000-memory.dmp
      Filesize

      980KB

    • memory/2756-195-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-177-0x0000000003120000-0x0000000003130000-memory.dmp
      Filesize

      64KB

    • memory/2756-179-0x0000000008310000-0x0000000008320000-memory.dmp
      Filesize

      64KB

    • memory/2756-178-0x0000000008310000-0x0000000008320000-memory.dmp
      Filesize

      64KB

    • memory/2756-180-0x0000000008310000-0x0000000008320000-memory.dmp
      Filesize

      64KB

    • memory/2756-181-0x0000000008310000-0x0000000008320000-memory.dmp
      Filesize

      64KB

    • memory/2756-182-0x0000000008310000-0x0000000008320000-memory.dmp
      Filesize

      64KB

    • memory/2756-183-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-184-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-185-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-186-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-194-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-188-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-189-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-190-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-191-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-192-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/2756-193-0x00000000011B0000-0x00000000011C0000-memory.dmp
      Filesize

      64KB

    • memory/3452-157-0x00000000012F0000-0x0000000001383000-memory.dmp
      Filesize

      588KB

    • memory/3452-156-0x0000000000D00000-0x0000000000D2F000-memory.dmp
      Filesize

      188KB

    • memory/3452-154-0x00000000015B0000-0x00000000018FA000-memory.dmp
      Filesize

      3.3MB

    • memory/3452-153-0x0000000000D00000-0x0000000000D2F000-memory.dmp
      Filesize

      188KB

    • memory/3452-152-0x0000000000030000-0x000000000003A000-memory.dmp
      Filesize

      40KB

    • memory/3452-150-0x0000000000000000-mapping.dmp
    • memory/3500-155-0x0000000000000000-mapping.dmp
    • memory/4972-144-0x0000000000000000-mapping.dmp
    • memory/4972-145-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4972-151-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4972-148-0x0000000001AA0000-0x0000000001AB4000-memory.dmp
      Filesize

      80KB

    • memory/4972-147-0x0000000001750000-0x0000000001A9A000-memory.dmp
      Filesize

      3.3MB