Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
28/01/2023, 17:23
General
- Target Scannedfile.exe
- Size 350KB
- Sample230128-vx5d6afd68
- SHA256 e15ba8be78ecdfc804dba4fbce9e14eaef0d84ec4c9b82d5d8b109c64a566266
Malware Config
Extracted
-
formbook
-
dcn0
-
ZVx68vDtAMBCwg==
-
oBMBvsNORkM/O/ox
-
Ff9pISWkm6eG4lByIspp
-
c2T42c6CIIF6B8xTxm9XzpVw
-
bvjhxRbnAC183w==
-
0lTttSNG4HUDNflyIspp
-
hPXFlstqiHA/O/ox
-
WLR+MeerxZ0cNn1ja+IQAYo=
-
IHRn4xXOVKi477zarG+ObSy7YJA=
-
Xhf3e+tdAC183w==
-
Xk0ZAezv2rWH
-
kngo+vBeSRN7AszNwam3Osmguuqc0MoC
-
a2Qp7a+E8fSw7LDjpnqEKjsRZA==
-
3zjy4E7+QM48wg==
-
YcCmqT3OUNAigVott2pBKiy7YJA=
-
4+SMeX1juat/5cZ1AZihcyy7YJA=
-
/+m7sro0OBTl3TMpCw==
-
i2ctEfe4//a64yklMsgS2J90
-
+loZ2QKGX0UWgpvErMs=
-
b9BNCnJWQJS8IfsR0uR3bCy7YJA=
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Executes dropped EXE 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scannedfile.exe"C:\Users\Admin\AppData\Local\Temp\Scannedfile.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vmkhea.exe"C:\Users\Admin\AppData\Local\Temp\vmkhea.exe" C:\Users\Admin\AppData\Local\Temp\mpivddpz.tri3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vmkhea.exe"C:\Users\Admin\AppData\Local\Temp\vmkhea.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
iqjvzfk.ue
mpivddpz.tri
vmkhea.exe
vmkhea.exe
vmkhea.exe
memory/792-143-0x0000000002CC0000-0x0000000002DFC000-memory.dmp
memory/792-151-0x0000000002E00000-0x0000000002EE7000-memory.dmp
memory/792-149-0x0000000002E00000-0x0000000002EE7000-memory.dmp
memory/4004-147-0x0000000001B10000-0x0000000001E5A000-memory.dmp
memory/4004-145-0x0000000000DB0000-0x0000000000E8C000-memory.dmp
memory/4004-146-0x00000000006F0000-0x000000000071D000-memory.dmp
memory/4004-148-0x00000000017A0000-0x000000000182F000-memory.dmp
memory/4004-150-0x00000000006F0000-0x000000000071D000-memory.dmp
memory/4368-141-0x0000000000A90000-0x0000000000DDA000-memory.dmp
memory/4368-142-0x00000000005B0000-0x00000000005C0000-memory.dmp
memory/4368-140-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4368-139-0x0000000000400000-0x000000000042E000-memory.dmp