Analysis

  • max time kernel
    170s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 18:41

General

  • Target

    #PO 4500515595 ULTRA TEC.exe

  • Size

    550KB

  • MD5

    5adbfe3a05eb61b2d2620b6538dc5772

  • SHA1

    8bee7a099e2c1753a62be196915da3756758e75c

  • SHA256

    d404e5865cddbf47f6a494f9120130035b3ac5761810dc75e20bc28873327547

  • SHA512

    5d66a876e199a1733c9c445cdb5d2c4d4842373a710c6a93c088d1d5456ef7c6a3308a56b1b00c5852457ec8db8108b1fe278f45b0dcc7b7433ea20b9e4a465c

  • SSDEEP

    12288:JZ725ZbHWLBajVyuexPgAHsP3o4roF6Btp3P:uCQSxPgAIogPBth

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ey16

Decoy

slimshotonline.com

rifaboa.com

metallzauber.com

jabandfuel.com

reacthat.com

qcgaeu.top

ssongg446.cfd

29kuan7.cfd

101agh.com

reliablii.com

luginfinity.com

e513.cloud

k4lantar.sbs

etoempire.com

phons.info

vovacom.com

birbakalim.fun

wellhousesctx.com

flthg.link

strasburgangus.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 5 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:776
    • C:\Users\Admin\AppData\Local\Temp\#PO 4500515595 ULTRA TEC.exe
      "C:\Users\Admin\AppData\Local\Temp\#PO 4500515595 ULTRA TEC.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3840
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gtpTbwW.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3540
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gtpTbwW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp82B8.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2164
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4992
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:400
      • C:\Windows\SysWOW64\autofmt.exe
        "C:\Windows\SysWOW64\autofmt.exe"
        2⤵
          PID:2692
        • C:\Windows\SysWOW64\autochk.exe
          "C:\Windows\SysWOW64\autochk.exe"
          2⤵
            PID:5044
          • C:\Windows\SysWOW64\wscript.exe
            "C:\Windows\SysWOW64\wscript.exe"
            2⤵
            • Blocklisted process makes network request
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3368
            • C:\Windows\SysWOW64\cmd.exe
              /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
              3⤵
                PID:3804

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gxxrvrnz.xng.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Users\Admin\AppData\Local\Temp\tmp82B8.tmp

                  Filesize

                  1KB

                  MD5

                  91a17735fc66345ccca918b9384e53ba

                  SHA1

                  56065f0ae5d7eafd937e2b0578e40a86eae1d65a

                  SHA256

                  f3fa972ce39f8177f330c0f3d351fc86b53fc4bacaa0cd9eebd4ad60265678ce

                  SHA512

                  8ebe5d17c153fe05b76516867c890b80dc88ad407819c321543cdb95e98d74f4fae52afab1e43fd176e8f3ce1868bc7bb1f48ceec4753f03501ebc6d55c7a75a

                • memory/776-83-0x0000000009170000-0x000000000929D000-memory.dmp

                  Filesize

                  1.2MB

                • memory/776-87-0x000000000BC90000-0x000000000BDEA000-memory.dmp

                  Filesize

                  1.4MB

                • memory/776-88-0x000000000BC90000-0x000000000BDEA000-memory.dmp

                  Filesize

                  1.4MB

                • memory/776-72-0x00000000094C0000-0x000000000965B000-memory.dmp

                  Filesize

                  1.6MB

                • memory/776-71-0x0000000009170000-0x000000000929D000-memory.dmp

                  Filesize

                  1.2MB

                • memory/776-44-0x00000000094C0000-0x000000000965B000-memory.dmp

                  Filesize

                  1.6MB

                • memory/776-90-0x000000000BC90000-0x000000000BDEA000-memory.dmp

                  Filesize

                  1.4MB

                • memory/3368-86-0x00000000023E0000-0x0000000002474000-memory.dmp

                  Filesize

                  592KB

                • memory/3368-84-0x0000000000550000-0x000000000057F000-memory.dmp

                  Filesize

                  188KB

                • memory/3368-82-0x0000000002670000-0x00000000029BA000-memory.dmp

                  Filesize

                  3.3MB

                • memory/3368-81-0x0000000000550000-0x000000000057F000-memory.dmp

                  Filesize

                  188KB

                • memory/3368-80-0x0000000000420000-0x0000000000447000-memory.dmp

                  Filesize

                  156KB

                • memory/3368-79-0x0000000000420000-0x0000000000447000-memory.dmp

                  Filesize

                  156KB

                • memory/3540-19-0x0000000005310000-0x0000000005320000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-63-0x0000000007BB0000-0x0000000007BBA000-memory.dmp

                  Filesize

                  40KB

                • memory/3540-21-0x0000000005950000-0x0000000005F78000-memory.dmp

                  Filesize

                  6.2MB

                • memory/3540-78-0x0000000074F00000-0x00000000756B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3540-76-0x0000000007E80000-0x0000000007E88000-memory.dmp

                  Filesize

                  32KB

                • memory/3540-25-0x0000000005860000-0x0000000005882000-memory.dmp

                  Filesize

                  136KB

                • memory/3540-18-0x0000000005310000-0x0000000005320000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-26-0x0000000006130000-0x0000000006196000-memory.dmp

                  Filesize

                  408KB

                • memory/3540-32-0x0000000006210000-0x0000000006276000-memory.dmp

                  Filesize

                  408KB

                • memory/3540-37-0x0000000006380000-0x00000000066D4000-memory.dmp

                  Filesize

                  3.3MB

                • memory/3540-75-0x0000000007EA0000-0x0000000007EBA000-memory.dmp

                  Filesize

                  104KB

                • memory/3540-40-0x0000000006820000-0x000000000683E000-memory.dmp

                  Filesize

                  120KB

                • memory/3540-74-0x0000000007DA0000-0x0000000007DB4000-memory.dmp

                  Filesize

                  80KB

                • memory/3540-17-0x0000000074F00000-0x00000000756B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3540-43-0x00000000068F0000-0x000000000693C000-memory.dmp

                  Filesize

                  304KB

                • memory/3540-73-0x0000000007D90000-0x0000000007D9E000-memory.dmp

                  Filesize

                  56KB

                • memory/3540-45-0x0000000005310000-0x0000000005320000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-46-0x000000007F0B0000-0x000000007F0C0000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-47-0x0000000006E00000-0x0000000006E32000-memory.dmp

                  Filesize

                  200KB

                • memory/3540-48-0x00000000717C0000-0x000000007180C000-memory.dmp

                  Filesize

                  304KB

                • memory/3540-58-0x0000000006DE0000-0x0000000006DFE000-memory.dmp

                  Filesize

                  120KB

                • memory/3540-59-0x0000000007A50000-0x0000000007AF3000-memory.dmp

                  Filesize

                  652KB

                • memory/3540-60-0x0000000008180000-0x00000000087FA000-memory.dmp

                  Filesize

                  6.5MB

                • memory/3540-61-0x0000000007B40000-0x0000000007B5A000-memory.dmp

                  Filesize

                  104KB

                • memory/3540-62-0x0000000074F00000-0x00000000756B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3540-16-0x0000000005240000-0x0000000005276000-memory.dmp

                  Filesize

                  216KB

                • memory/3540-64-0x0000000005310000-0x0000000005320000-memory.dmp

                  Filesize

                  64KB

                • memory/3540-65-0x0000000007DE0000-0x0000000007E76000-memory.dmp

                  Filesize

                  600KB

                • memory/3540-66-0x0000000007D60000-0x0000000007D71000-memory.dmp

                  Filesize

                  68KB

                • memory/3540-67-0x0000000005310000-0x0000000005320000-memory.dmp

                  Filesize

                  64KB

                • memory/3840-4-0x0000000004D40000-0x0000000004D50000-memory.dmp

                  Filesize

                  64KB

                • memory/3840-1-0x0000000000030000-0x00000000000BE000-memory.dmp

                  Filesize

                  568KB

                • memory/3840-0-0x0000000074F00000-0x00000000756B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3840-11-0x0000000008B10000-0x0000000008BAC000-memory.dmp

                  Filesize

                  624KB

                • memory/3840-2-0x00000000050A0000-0x0000000005644000-memory.dmp

                  Filesize

                  5.6MB

                • memory/3840-3-0x0000000004AF0000-0x0000000004B82000-memory.dmp

                  Filesize

                  584KB

                • memory/3840-6-0x0000000004D20000-0x0000000004D30000-memory.dmp

                  Filesize

                  64KB

                • memory/3840-24-0x0000000074F00000-0x00000000756B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3840-5-0x0000000004AA0000-0x0000000004AAA000-memory.dmp

                  Filesize

                  40KB

                • memory/3840-10-0x00000000064A0000-0x000000000650E000-memory.dmp

                  Filesize

                  440KB

                • memory/3840-9-0x0000000005F90000-0x0000000005F9C000-memory.dmp

                  Filesize

                  48KB

                • memory/3840-8-0x0000000004D40000-0x0000000004D50000-memory.dmp

                  Filesize

                  64KB

                • memory/3840-7-0x0000000074F00000-0x00000000756B0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4992-41-0x0000000000400000-0x000000000042F000-memory.dmp

                  Filesize

                  188KB

                • memory/4992-22-0x0000000000400000-0x000000000042F000-memory.dmp

                  Filesize

                  188KB

                • memory/4992-38-0x00000000016E0000-0x0000000001A2A000-memory.dmp

                  Filesize

                  3.3MB

                • memory/4992-42-0x0000000001390000-0x00000000013A5000-memory.dmp

                  Filesize

                  84KB

                • memory/4992-69-0x0000000000400000-0x000000000042F000-memory.dmp

                  Filesize

                  188KB

                • memory/4992-70-0x0000000001400000-0x0000000001415000-memory.dmp

                  Filesize

                  84KB