Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
13/12/2022, 04:30
General
- Target SecuriteInfo.com.Trojan.Garf.Gen.6.7190.31519.exe
- Size 272KB
- Sample221213-e4tm8sde74
- SHA256 afb4878ecf77a506fee3c5d2b817d8197edd0df8baddb32563027023e6bf35cc
Malware Config
Extracted
-
formbook
-
scse
-
SKpYFyVNT2zunKf0uuM=
-
FlEHUseI7I5XbrO8fR/XBcS9ZA==
-
FPuxoUOxkLiATugw
-
VKdxsDSk0jdT5Kw=
-
FpqHf9iI/1tl97E=
-
YGI6sIl3UIxfZvlD+JiUuuLR
-
oBAEO0suBEAD5aK00A==
-
RKJqTzg4gQ/Q6DYSuTjDGkwuyl0ik5Kb8w==
-
VFg9s3W0/Ype8A3cZb+D7g==
-
hwD+VNd6014nrsaTWm4FBcS9ZA==
-
zkAdUq1soKYUfZaTqLmL
-
XVQ9WbRivUIQ477a/hKv+g==
-
QireF2geizAwmp674AGc5g==
-
PSTUQxs6j8OATugw
-
LHJhyy2VbX8NEqf0uuM=
-
MiY1vg6T3HqATugw
-
wqkUjaVXnGgBqA==
-
jUr/eUtSIT01Wegt
-
PjQidcqKzAbSZICUZb+D7g==
-
OkAmcv12sUEAIHwFHakzdIo2FPHw
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Executes dropped EXE 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Garf.Gen.6.7190.31519.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Garf.Gen.6.7190.31519.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\otjcwtdly.exe"C:\Users\Admin\AppData\Local\Temp\otjcwtdly.exe" C:\Users\Admin\AppData\Local\Temp\zbaerndijaa.sqr3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\otjcwtdly.exe"C:\Users\Admin\AppData\Local\Temp\otjcwtdly.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
axtruztvea.wb
otjcwtdly.exe
otjcwtdly.exe
otjcwtdly.exe
zbaerndijaa.sqr
memory/208-142-0x00000000005B0000-0x00000000005C0000-memory.dmp
memory/208-139-0x0000000000400000-0x000000000042E000-memory.dmp
memory/208-140-0x0000000000400000-0x000000000042E000-memory.dmp
memory/208-141-0x0000000000B60000-0x0000000000EAA000-memory.dmp
memory/1044-183-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-171-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-199-0x00000000006E0000-0x00000000006F0000-memory.dmp
memory/1044-200-0x00000000006E0000-0x00000000006F0000-memory.dmp
memory/1044-198-0x00000000006E0000-0x00000000006F0000-memory.dmp
memory/1044-197-0x00000000005C0000-0x00000000005D0000-memory.dmp
memory/1044-196-0x00000000006E0000-0x00000000006F0000-memory.dmp
memory/1044-149-0x0000000008360000-0x0000000008483000-memory.dmp
memory/1044-195-0x00000000006E0000-0x00000000006F0000-memory.dmp
memory/1044-151-0x0000000008360000-0x0000000008483000-memory.dmp
memory/1044-152-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-153-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-154-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-155-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-156-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-157-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-158-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-159-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-160-0x00000000005B0000-0x00000000005C0000-memory.dmp
memory/1044-161-0x00000000025D0000-0x00000000025E0000-memory.dmp
memory/1044-162-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-163-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-164-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-165-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-166-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-167-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-168-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-169-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-170-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-143-0x0000000006EF0000-0x000000000700D000-memory.dmp
memory/1044-172-0x00000000025D0000-0x00000000025E0000-memory.dmp
memory/1044-173-0x00000000025D0000-0x00000000025E0000-memory.dmp
memory/1044-174-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-175-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-178-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-177-0x00000000005C0000-0x00000000005D0000-memory.dmp
memory/1044-176-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-179-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-180-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-181-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-182-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-194-0x00000000006E0000-0x00000000006F0000-memory.dmp
memory/1044-184-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-185-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-186-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-187-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-188-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-189-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-190-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-191-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-192-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1044-193-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/3596-150-0x00000000012F0000-0x000000000131D000-memory.dmp
memory/3596-148-0x0000000003030000-0x00000000030BF000-memory.dmp
memory/3596-147-0x0000000003200000-0x000000000354A000-memory.dmp
memory/3596-146-0x00000000012F0000-0x000000000131D000-memory.dmp
memory/3596-145-0x0000000000B10000-0x0000000000B37000-memory.dmp