Analysis
- max time kernel
148s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
13/12/2022, 16:00
General
- Target b89438b8ad038b570457bc1bb4e80a73.exe
- Size 432KB
- Sample221213-tfm8wafa73
- SHA256 548fb330ffeb62ab1fd674a557606885338344c8cc807e2a3f9c64e475bdf2c0
Malware Config
Extracted
-
formbook
-
4.1
-
lt63
-
fortrantelecom.africa
-
ffafa.buzz
-
bullybrain.com
-
ekeisolutions.com
-
lamiamira.com
-
noahsark.xyz
-
beautyby-eve.com
-
cloudfatory.com
-
12443.football
-
hataykultur.online
-
donqu3.sexy
-
breakthroughaustralia.com
-
havengpe.com
-
cpxlocatup.info
-
corefourpartners.com
-
amonefintech.com
-
thithombo.africa
-
bassmaty.store
-
fdshdsr.top
-
lifesoapsimple.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b89438b8ad038b570457bc1bb4e80a73.exe"C:\Users\Admin\AppData\Local\Temp\b89438b8ad038b570457bc1bb4e80a73.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\avhga.exe"C:\Users\Admin\AppData\Local\Temp\avhga.exe" C:\Users\Admin\AppData\Local\Temp\lmfao.o3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\avhga.exe"C:\Users\Admin\AppData\Local\Temp\avhga.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\avhga.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
avhga.exe
avhga.exe
avhga.exe
kbipkhv.h
lmfao.o
memory/1300-187-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-190-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-207-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1300-206-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1300-205-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1300-142-0x0000000003400000-0x00000000034C4000-memory.dmp
memory/1300-173-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-144-0x00000000091A0000-0x00000000092DD000-memory.dmp
memory/1300-204-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/1300-171-0x0000000003560000-0x0000000003570000-memory.dmp
memory/1300-203-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1300-202-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1300-201-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1300-200-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/1300-199-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-152-0x0000000007CB0000-0x0000000007D6B000-memory.dmp
memory/1300-198-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-154-0x0000000007CB0000-0x0000000007D6B000-memory.dmp
memory/1300-155-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-156-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-157-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-158-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-159-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-160-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-161-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-162-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-163-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-164-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-166-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-169-0x0000000003560000-0x0000000003570000-memory.dmp
memory/1300-168-0x0000000001340000-0x0000000001350000-memory.dmp
memory/1300-167-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-170-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-174-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-197-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-179-0x0000000003560000-0x0000000003570000-memory.dmp
memory/1300-196-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-176-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-177-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-178-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-172-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-175-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-180-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-181-0x0000000003560000-0x0000000003570000-memory.dmp
memory/1300-182-0x0000000003560000-0x0000000003570000-memory.dmp
memory/1300-183-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-184-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-185-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-186-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-195-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-188-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-189-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-194-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-191-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-192-0x0000000001330000-0x0000000001340000-memory.dmp
memory/1300-193-0x0000000001330000-0x0000000001340000-memory.dmp
memory/3660-150-0x0000000002D50000-0x000000000309A000-memory.dmp
memory/3660-153-0x0000000000BB0000-0x0000000000BDF000-memory.dmp
memory/3660-151-0x0000000002AF0000-0x0000000002B83000-memory.dmp
memory/3660-149-0x0000000000BB0000-0x0000000000BDF000-memory.dmp
memory/3660-148-0x0000000000A90000-0x0000000000AA9000-memory.dmp
memory/4304-146-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4304-143-0x0000000000940000-0x0000000000954000-memory.dmp
memory/4304-141-0x00000000006D0000-0x00000000006E4000-memory.dmp
memory/4304-140-0x00000000009A0000-0x0000000000CEA000-memory.dmp
memory/4304-139-0x0000000000400000-0x000000000042F000-memory.dmp