Analysis

  • max time kernel
    150s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 10:32

General

  • Target

    ახალი შესყიდვის შეკვეთა pdf.exe

  • Size

    658KB

  • MD5

    f891581195d4a3eb2b70d8dd5b7e2fa7

  • SHA1

    ce7058980b99c9c53ef77361e27848a2c31901cf

  • SHA256

    ec631a873ad900f187bc34ba3d92c950ac3d20949147104414e03096a703cc64

  • SHA512

    f9791f466a1434ac754117e9bf46a22c6b2dd541fcd8bacce331184fa12886114915978f2c8a8eb3ca18a0a1273a334b975af01c9be0e7f1632c4d08ed6c7f7d

  • SSDEEP

    12288:3MgFWMjgR/mZRM+ByVw9yFgbuFZMlfJJT4nhLqOxLSRPQ12WAGTeoWIGmpqNN:jjgkZR5YbOwZMtLchWOxLSRPQDHTDxu/

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g11y

Decoy

bayivip.top

lunarrhythmsliving.com

elizabethanbello.art

plushkitchen.com

timedb.net

exploringaging.com

dreamoney.online

luvisusllc.com

strikemedialabs.com

belvederesportsclub.com

turteen.com

theofficialtrumpcards.com

x-y-z.online

otuvu.com

outhandsbpm.com

scabiosa.top

99job.store

afcxz80whz.com

mysrz3l47.top

sarekaonsaddle.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Users\Admin\AppData\Local\Temp\ახალი შესყიდვის შეკვეთა pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\ახალი შესყიდვის შეკვეთა pdf.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\idScXbUauEgmY.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4452
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\idScXbUauEgmY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp174C.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2924
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2388
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2112
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:1732

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yuggw15j.zlb.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\tmp174C.tmp

            Filesize

            1KB

            MD5

            7f803b32133a013d5421934e61d039fe

            SHA1

            8390d1a901df668a9fee0c732302c7e44f048d77

            SHA256

            6fe3888d112736409b1ef124405c7b8461b63305680ef415bcc9b902f3e084b7

            SHA512

            33ad560a69da6edb01e378e5cd1448ccd6303774d7b3edd53d09f89be586837e32815492ad0aa40d50f733d9c92126409fb48f2feb11ae2d08eef4cff7b34ced

          • memory/2112-70-0x0000000000A90000-0x0000000000ABF000-memory.dmp

            Filesize

            188KB

          • memory/2112-68-0x0000000000FE0000-0x0000000000FEE000-memory.dmp

            Filesize

            56KB

          • memory/2112-84-0x0000000001400000-0x0000000001494000-memory.dmp

            Filesize

            592KB

          • memory/2112-66-0x0000000000FE0000-0x0000000000FEE000-memory.dmp

            Filesize

            56KB

          • memory/2112-81-0x0000000000A90000-0x0000000000ABF000-memory.dmp

            Filesize

            188KB

          • memory/2112-73-0x0000000001600000-0x000000000194A000-memory.dmp

            Filesize

            3.3MB

          • memory/2388-23-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2388-42-0x0000000001300000-0x0000000001315000-memory.dmp

            Filesize

            84KB

          • memory/2388-41-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2388-39-0x0000000001370000-0x00000000016BA000-memory.dmp

            Filesize

            3.3MB

          • memory/3228-85-0x0000000007D00000-0x0000000007DA9000-memory.dmp

            Filesize

            676KB

          • memory/3228-82-0x0000000007BE0000-0x0000000007CD5000-memory.dmp

            Filesize

            980KB

          • memory/3228-44-0x0000000007BE0000-0x0000000007CD5000-memory.dmp

            Filesize

            980KB

          • memory/3228-86-0x0000000007D00000-0x0000000007DA9000-memory.dmp

            Filesize

            676KB

          • memory/3228-88-0x0000000007D00000-0x0000000007DA9000-memory.dmp

            Filesize

            676KB

          • memory/4452-18-0x00000000747F0000-0x0000000074FA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4452-46-0x0000000000D90000-0x0000000000DA0000-memory.dmp

            Filesize

            64KB

          • memory/4452-21-0x0000000004D70000-0x0000000005398000-memory.dmp

            Filesize

            6.2MB

          • memory/4452-25-0x0000000004A40000-0x0000000004A62000-memory.dmp

            Filesize

            136KB

          • memory/4452-27-0x0000000004C60000-0x0000000004CC6000-memory.dmp

            Filesize

            408KB

          • memory/4452-28-0x0000000005510000-0x0000000005576000-memory.dmp

            Filesize

            408KB

          • memory/4452-80-0x00000000747F0000-0x0000000074FA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4452-22-0x0000000000D90000-0x0000000000DA0000-memory.dmp

            Filesize

            64KB

          • memory/4452-38-0x0000000005580000-0x00000000058D4000-memory.dmp

            Filesize

            3.3MB

          • memory/4452-77-0x0000000007160000-0x0000000007168000-memory.dmp

            Filesize

            32KB

          • memory/4452-17-0x0000000000DA0000-0x0000000000DD6000-memory.dmp

            Filesize

            216KB

          • memory/4452-19-0x0000000000D90000-0x0000000000DA0000-memory.dmp

            Filesize

            64KB

          • memory/4452-76-0x0000000007180000-0x000000000719A000-memory.dmp

            Filesize

            104KB

          • memory/4452-43-0x00000000048A0000-0x00000000048BE000-memory.dmp

            Filesize

            120KB

          • memory/4452-45-0x0000000006150000-0x000000000619C000-memory.dmp

            Filesize

            304KB

          • memory/4452-71-0x00000000070C0000-0x0000000007156000-memory.dmp

            Filesize

            600KB

          • memory/4452-47-0x00000000747F0000-0x0000000074FA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4452-60-0x0000000006070000-0x000000000608E000-memory.dmp

            Filesize

            120KB

          • memory/4452-50-0x0000000070FE0000-0x000000007102C000-memory.dmp

            Filesize

            304KB

          • memory/4452-49-0x000000007F110000-0x000000007F120000-memory.dmp

            Filesize

            64KB

          • memory/4452-48-0x00000000060B0000-0x00000000060E2000-memory.dmp

            Filesize

            200KB

          • memory/4452-61-0x0000000006D30000-0x0000000006DD3000-memory.dmp

            Filesize

            652KB

          • memory/4452-62-0x0000000007460000-0x0000000007ADA000-memory.dmp

            Filesize

            6.5MB

          • memory/4452-63-0x0000000006E20000-0x0000000006E3A000-memory.dmp

            Filesize

            104KB

          • memory/4452-64-0x0000000006EB0000-0x0000000006EBA000-memory.dmp

            Filesize

            40KB

          • memory/4452-65-0x0000000000D90000-0x0000000000DA0000-memory.dmp

            Filesize

            64KB

          • memory/4452-75-0x0000000007080000-0x0000000007094000-memory.dmp

            Filesize

            80KB

          • memory/4452-74-0x0000000007070000-0x000000000707E000-memory.dmp

            Filesize

            56KB

          • memory/4452-69-0x0000000000D90000-0x0000000000DA0000-memory.dmp

            Filesize

            64KB

          • memory/4452-72-0x0000000007040000-0x0000000007051000-memory.dmp

            Filesize

            68KB

          • memory/4532-12-0x0000000006AD0000-0x0000000006B3E000-memory.dmp

            Filesize

            440KB

          • memory/4532-7-0x0000000005BB0000-0x0000000005BCC000-memory.dmp

            Filesize

            112KB

          • memory/4532-8-0x0000000005B90000-0x0000000005B9C000-memory.dmp

            Filesize

            48KB

          • memory/4532-9-0x00000000747F0000-0x0000000074FA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4532-10-0x00000000058C0000-0x00000000058D0000-memory.dmp

            Filesize

            64KB

          • memory/4532-11-0x0000000003370000-0x0000000003380000-memory.dmp

            Filesize

            64KB

          • memory/4532-0-0x00000000747F0000-0x0000000074FA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4532-26-0x00000000747F0000-0x0000000074FA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4532-6-0x0000000005C50000-0x0000000005CEC000-memory.dmp

            Filesize

            624KB

          • memory/4532-5-0x0000000005B00000-0x0000000005B0A000-memory.dmp

            Filesize

            40KB

          • memory/4532-4-0x00000000058C0000-0x00000000058D0000-memory.dmp

            Filesize

            64KB

          • memory/4532-3-0x0000000005950000-0x00000000059E2000-memory.dmp

            Filesize

            584KB

          • memory/4532-2-0x0000000005F00000-0x00000000064A4000-memory.dmp

            Filesize

            5.6MB

          • memory/4532-1-0x0000000000EB0000-0x0000000000F5A000-memory.dmp

            Filesize

            680KB