Analysis
- max time kernel
148s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
14/02/2023, 14:58
General
- Target HiU4VL9BMkwVhsG.exe
- Size 975KB
- Sample230214-sb6c8aec32
- SHA256 f1cb8bd9cdf78abe8ebb1fdffe785c8a681f3c984c5f06a77b7de74934c64aa3
Malware Config
Extracted
-
formbook
-
g44n
-
t60gB4YRvsDLttd9HG4=
-
xck8G7COQ+g7VIpX
-
BQQF3mmpLPskhQ==
-
eLWwmzNyK6ee+nF1jDvvkxuSGA==
-
3tlgNOzw8BBjpNOQMnc=
-
nOpNEJhoU0h+00S9E1YfgA==
-
xcvTpljkjIyEdvhp+VcGFtJC
-
bZxOHr5CtzY4
-
rOD304X0u1DN/m7cbA==
-
Knixl0HJyEOOiNckwk8GFtJC
-
S4JMDRNTUAol
-
Vp9wSwNZSfY7VIpX
-
0Nf/zlrpmpahnM+tpkYGFtJC
-
joXsuHiBcVp88DHEHMA7
-
yN8i9ppoZYHSSaqqk6NZnQ==
-
4UFEMfyKhSB4UovzjdabqolwhFtMH1M=
-
d3RiRcXCeR8wlgjEHMA7
-
eMUS8PSBPCe2rPg=
-
LCsR0X328UuSAmlf
-
/keifSXopayqjLt1EWQ=
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HiU4VL9BMkwVhsG.exe"C:\Users\Admin\AppData\Local\Temp\HiU4VL9BMkwVhsG.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HiU4VL9BMkwVhsG.exe"C:\Users\Admin\AppData\Local\Temp\HiU4VL9BMkwVhsG.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HiU4VL9BMkwVhsG.exe"C:\Users\Admin\AppData\Local\Temp\HiU4VL9BMkwVhsG.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2160-145-0x0000000000422000-0x0000000000424000-memory.dmp
memory/2160-142-0x0000000000401000-0x000000000042F000-memory.dmp
memory/2160-151-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2160-149-0x0000000000401000-0x000000000042F000-memory.dmp
memory/2160-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2160-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2160-146-0x0000000000F40000-0x0000000000F50000-memory.dmp
memory/2160-144-0x00000000014F0000-0x000000000183A000-memory.dmp
memory/2312-135-0x0000000005930000-0x000000000593A000-memory.dmp
memory/2312-134-0x0000000005940000-0x00000000059D2000-memory.dmp
memory/2312-133-0x0000000005E10000-0x00000000063B4000-memory.dmp
memory/2312-132-0x0000000000E80000-0x0000000000F7A000-memory.dmp
memory/2312-136-0x0000000008340000-0x00000000083DC000-memory.dmp
memory/2648-147-0x0000000008800000-0x000000000892B000-memory.dmp
memory/2648-157-0x0000000008930000-0x0000000008A61000-memory.dmp
memory/2648-156-0x0000000008930000-0x0000000008A61000-memory.dmp
memory/4668-150-0x0000000000760000-0x0000000000787000-memory.dmp
memory/4668-154-0x0000000002460000-0x00000000024EF000-memory.dmp
memory/4668-155-0x0000000000180000-0x00000000001AD000-memory.dmp
memory/4668-152-0x0000000000180000-0x00000000001AD000-memory.dmp
memory/4668-153-0x0000000002540000-0x000000000288A000-memory.dmp