Analysis
- max time kernel
324s - max time network
376s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
06/12/2022, 08:04
General
- Target f0a448d757645c4c8159d946be6cd741.exe
- Size 225KB
- Sample221206-jx94vsgh74
- SHA256 22d3aa3de84b7d01eccdf2471c93da8cbdbf39afc3a1c149d2109f2f9644f5d7
Malware Config
Extracted
-
formbook
-
henz
-
IxWMb+jVsoinShuZJzk=
-
TPfKgQZ//oGnKr/J
-
EsK0WxD5kY65XOW1Td/5CxSUpCUytR7M
-
KebSmiCP9p8yUw==
-
HAt/ljkEuqMLHOLCi53Pv8MKX9qk
-
CY4ogZTwJc4vSw==
-
WWDIx5UYUDyepntE0YIAPca3/rI=
-
+Pkr01Lfb2rME7bL
-
S5nyK0p8jS2xdwQ=
-
W/oqvlO57LfkLcLHnQ==
-
zrrwtqkTLwxulm4l8FGopw==
-
AqucYext8bzFbOKthIm8E6gfVkUHxKY=
-
OfnjeDs78+RTcz4OHRl+
-
XKf1wwpZR5hLLjHgmUGOpQ==
-
JMyhSLoJPTCwn5o9zX2d8i1+
-
Wk54MBsDhWSVbnIRkQ==
-
7aaYR/tOhh9piTw5/KHSRwuK2iqgafw7pQ==
-
hH/EYxN+jC2xdwQ=
-
S0F4ORqDjS2xdwQ=
-
0o/UwXnuJ+sJp0cOHRl+
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Executes dropped EXE 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f0a448d757645c4c8159d946be6cd741.exe"C:\Users\Admin\AppData\Local\Temp\f0a448d757645c4c8159d946be6cd741.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xdzkcooocd.exe"C:\Users\Admin\AppData\Local\Temp\xdzkcooocd.exe" C:\Users\Admin\AppData\Local\Temp\ciejdgh.ks3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xdzkcooocd.exe"C:\Users\Admin\AppData\Local\Temp\xdzkcooocd.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
ciejdgh.ks
ljilba.ize
xdzkcooocd.exe
xdzkcooocd.exe
xdzkcooocd.exe
memory/808-150-0x0000000000140000-0x000000000014E000-memory.dmp
memory/808-156-0x0000000000960000-0x000000000098D000-memory.dmp
memory/808-154-0x0000000001490000-0x000000000151F000-memory.dmp
memory/808-153-0x0000000001600000-0x000000000194A000-memory.dmp
memory/808-152-0x0000000000960000-0x000000000098D000-memory.dmp
memory/1812-148-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1812-142-0x0000000000EE0000-0x0000000000EF0000-memory.dmp
memory/1812-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1812-140-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1812-144-0x0000000000F50000-0x0000000000F60000-memory.dmp
memory/1812-149-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1812-141-0x0000000001210000-0x000000000155A000-memory.dmp
memory/2600-143-0x00000000091E0000-0x000000000931D000-memory.dmp
memory/2600-151-0x0000000009320000-0x0000000009447000-memory.dmp
memory/2600-146-0x00000000091E0000-0x000000000931D000-memory.dmp
memory/2600-155-0x0000000008EC0000-0x0000000008F72000-memory.dmp
memory/2600-145-0x0000000009320000-0x0000000009447000-memory.dmp
memory/2600-157-0x0000000008EC0000-0x0000000008F72000-memory.dmp