Analysis
- max time kernel
151s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
09/12/2022, 20:03
General
- Target e17b0be6e0c42a0c39c5da63523af8d8.exe
- Size 530KB
- Sample221209-yspdxseb56
- SHA256 7eb67be31871fe9316bbb2ba993b6dfd13cb9e7e04a2e1091b934746399e5293
Malware Config
Extracted
-
formbook
-
4.1
-
wh23
-
ow9vyvfee.com
-
alvis.one
-
mutantgobz.claims
-
plynofon.com
-
southofkingst.store
-
nuvidamedspa.com
-
coffeeforyou56.com
-
opaletechevents.com
-
momobar.life
-
abcmousu.com
-
learnicd-11.com
-
tipokin.xyz
-
kahvezevki.com
-
suratdimond.com
-
oldartists.best
-
infoepic.info
-
mattresslabo.com
-
skarlmotors.com
-
cl9319x.xyz
-
med49app.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e17b0be6e0c42a0c39c5da63523af8d8.exe"C:\Users\Admin\AppData\Local\Temp\e17b0be6e0c42a0c39c5da63523af8d8.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\myxwn.exe"C:\Users\Admin\AppData\Local\Temp\myxwn.exe" C:\Users\Admin\AppData\Local\Temp\getlceffch.gqb3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\myxwn.exe"C:\Users\Admin\AppData\Local\Temp\myxwn.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\myxwn.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
eilfol.tsc
getlceffch.gqb
myxwn.exe
myxwn.exe
myxwn.exe
memory/1600-144-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1600-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1600-140-0x0000000000A90000-0x0000000000DDA000-memory.dmp
memory/1600-141-0x00000000009F0000-0x0000000000A04000-memory.dmp
memory/3048-142-0x00000000075E0000-0x0000000007721000-memory.dmp
memory/3048-150-0x00000000024F0000-0x00000000025E0000-memory.dmp
memory/3048-152-0x00000000024F0000-0x00000000025E0000-memory.dmp
memory/4340-145-0x0000000000780000-0x00000000007A7000-memory.dmp
memory/4340-146-0x0000000000B30000-0x0000000000B5F000-memory.dmp
memory/4340-148-0x0000000002CB0000-0x0000000002FFA000-memory.dmp
memory/4340-149-0x0000000002A50000-0x0000000002AE3000-memory.dmp
memory/4340-151-0x0000000000B30000-0x0000000000B5F000-memory.dmp