Analysis

  • max time kernel
    141s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 19:35

General

  • Target

    NEAS.f98b2fefbfa54e17d684f60629172f5f160259a6041b671f423eefbf0e51f949exe_JC.exe

  • Size

    635KB

  • MD5

    0d92c4776d31205c7b2275d1a78b4085

  • SHA1

    985fba4c665f1f1250df0a85c3169bc631d9e0a5

  • SHA256

    f98b2fefbfa54e17d684f60629172f5f160259a6041b671f423eefbf0e51f949

  • SHA512

    965c80653a4e4a0bfaacd60131248aaf15fca1487df8a72f2780c7fba63e6a09227252271cb1e5d8547a241ec644e16b924dd1cf683f39b08f3cbf08b8008e22

  • SSDEEP

    12288:Noj7s93wIxbzM1k19Rvt7l+SAd+GSJnhY5RgzTaz6uiczg:Oj7s93nfxfha7SJCuOz9k

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

eg02

Decoy

erc20.gold

elainevannmorgan.photography

melbet-el4.top

guvenilir.bet

sesamecsre.com

kevinjaydenwivano.tech

condohotelguru.com

shjcdz.com

innocarta.store

collinstradingpost.com

6om3j4.top

nagtco.xyz

fasist.fit

arkansaspremiertournaments.com

mrscsnowschool.com

ma-group.online

lillyjriley.icu

electric-cars-87253.bond

lila.tools

hollamia.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.f98b2fefbfa54e17d684f60629172f5f160259a6041b671f423eefbf0e51f949exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f98b2fefbfa54e17d684f60629172f5f160259a6041b671f423eefbf0e51f949exe_JC.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Ruwtgxl.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2136
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\Ruwtgxl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC80.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4648
    • C:\Users\Admin\AppData\Local\Temp\NEAS.f98b2fefbfa54e17d684f60629172f5f160259a6041b671f423eefbf0e51f949exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f98b2fefbfa54e17d684f60629172f5f160259a6041b671f423eefbf0e51f949exe_JC.exe"
      2⤵
        PID:536
      • C:\Users\Admin\AppData\Local\Temp\NEAS.f98b2fefbfa54e17d684f60629172f5f160259a6041b671f423eefbf0e51f949exe_JC.exe
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f98b2fefbfa54e17d684f60629172f5f160259a6041b671f423eefbf0e51f949exe_JC.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4492

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wwa1rupn.1pd.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\tmpDC80.tmp

            Filesize

            1KB

            MD5

            500df10857a68de1b401fade0c212076

            SHA1

            9dca19b9bca5d10f3a4d2afc8fae0a90dcfa7a48

            SHA256

            eb6f0668b55eae6bfa08e6266dc5378fa8925555d2510df5662ade9dc4aeab5d

            SHA512

            8bca9aa5e2f12997bb6c4b3f5207ae0e6648730d66d1fd081a945b1364f4f2a6048161b6794768bb2336fc655bb3525c4cdb0d86a4f5a2677de6a46145b81da9

          • memory/1744-6-0x0000000074520000-0x0000000074CD0000-memory.dmp

            Filesize

            7.7MB

          • memory/1744-3-0x0000000005870000-0x0000000005902000-memory.dmp

            Filesize

            584KB

          • memory/1744-4-0x0000000005810000-0x0000000005820000-memory.dmp

            Filesize

            64KB

          • memory/1744-5-0x0000000005940000-0x000000000594A000-memory.dmp

            Filesize

            40KB

          • memory/1744-2-0x0000000005D20000-0x00000000062C4000-memory.dmp

            Filesize

            5.6MB

          • memory/1744-7-0x0000000005CA0000-0x0000000005CB8000-memory.dmp

            Filesize

            96KB

          • memory/1744-8-0x0000000005810000-0x0000000005820000-memory.dmp

            Filesize

            64KB

          • memory/1744-9-0x0000000000F50000-0x0000000000F60000-memory.dmp

            Filesize

            64KB

          • memory/1744-10-0x00000000017C0000-0x000000000182E000-memory.dmp

            Filesize

            440KB

          • memory/1744-11-0x0000000006D90000-0x0000000006E2C000-memory.dmp

            Filesize

            624KB

          • memory/1744-1-0x0000000000DF0000-0x0000000000E94000-memory.dmp

            Filesize

            656KB

          • memory/1744-0-0x0000000074520000-0x0000000074CD0000-memory.dmp

            Filesize

            7.7MB

          • memory/1744-27-0x0000000074520000-0x0000000074CD0000-memory.dmp

            Filesize

            7.7MB

          • memory/2136-31-0x0000000002290000-0x00000000022A0000-memory.dmp

            Filesize

            64KB

          • memory/2136-45-0x0000000002290000-0x00000000022A0000-memory.dmp

            Filesize

            64KB

          • memory/2136-21-0x0000000004CF0000-0x0000000005318000-memory.dmp

            Filesize

            6.2MB

          • memory/2136-71-0x0000000074520000-0x0000000074CD0000-memory.dmp

            Filesize

            7.7MB

          • memory/2136-24-0x0000000005420000-0x0000000005442000-memory.dmp

            Filesize

            136KB

          • memory/2136-18-0x0000000002290000-0x00000000022A0000-memory.dmp

            Filesize

            64KB

          • memory/2136-68-0x00000000074A0000-0x00000000074A8000-memory.dmp

            Filesize

            32KB

          • memory/2136-29-0x0000000074520000-0x0000000074CD0000-memory.dmp

            Filesize

            7.7MB

          • memory/2136-30-0x0000000002290000-0x00000000022A0000-memory.dmp

            Filesize

            64KB

          • memory/2136-17-0x0000000074520000-0x0000000074CD0000-memory.dmp

            Filesize

            7.7MB

          • memory/2136-16-0x00000000022A0000-0x00000000022D6000-memory.dmp

            Filesize

            216KB

          • memory/2136-35-0x00000000057C0000-0x0000000005826000-memory.dmp

            Filesize

            408KB

          • memory/2136-40-0x00000000059A0000-0x0000000005A06000-memory.dmp

            Filesize

            408KB

          • memory/2136-41-0x0000000005B30000-0x0000000005E84000-memory.dmp

            Filesize

            3.3MB

          • memory/2136-42-0x0000000005F00000-0x0000000005F1E000-memory.dmp

            Filesize

            120KB

          • memory/2136-43-0x00000000060A0000-0x00000000060EC000-memory.dmp

            Filesize

            304KB

          • memory/2136-44-0x0000000002290000-0x00000000022A0000-memory.dmp

            Filesize

            64KB

          • memory/2136-19-0x0000000002290000-0x00000000022A0000-memory.dmp

            Filesize

            64KB

          • memory/2136-46-0x000000007FBE0000-0x000000007FBF0000-memory.dmp

            Filesize

            64KB

          • memory/2136-47-0x0000000006430000-0x0000000006462000-memory.dmp

            Filesize

            200KB

          • memory/2136-48-0x0000000070A10000-0x0000000070A5C000-memory.dmp

            Filesize

            304KB

          • memory/2136-58-0x0000000006410000-0x000000000642E000-memory.dmp

            Filesize

            120KB

          • memory/2136-59-0x00000000070B0000-0x0000000007153000-memory.dmp

            Filesize

            652KB

          • memory/2136-60-0x00000000077E0000-0x0000000007E5A000-memory.dmp

            Filesize

            6.5MB

          • memory/2136-61-0x0000000007180000-0x000000000719A000-memory.dmp

            Filesize

            104KB

          • memory/2136-62-0x00000000071F0000-0x00000000071FA000-memory.dmp

            Filesize

            40KB

          • memory/2136-63-0x0000000007400000-0x0000000007496000-memory.dmp

            Filesize

            600KB

          • memory/2136-64-0x0000000007380000-0x0000000007391000-memory.dmp

            Filesize

            68KB

          • memory/2136-65-0x00000000073B0000-0x00000000073BE000-memory.dmp

            Filesize

            56KB

          • memory/2136-66-0x00000000073C0000-0x00000000073D4000-memory.dmp

            Filesize

            80KB

          • memory/2136-67-0x00000000074C0000-0x00000000074DA000-memory.dmp

            Filesize

            104KB

          • memory/4492-28-0x0000000001370000-0x00000000016BA000-memory.dmp

            Filesize

            3.3MB

          • memory/4492-22-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB