Analysis
- max time kernel
119s - max time network
121s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
28/03/2024, 04:20
General
- Target SecuriteInfo.com.Win32.PWSX-gen.21551.10154.exe
- Size 629KB
- Sample240328-ex5rxseb7x
- SHA256 8859d68e69b5464a0100ca99aed26dec828ae92287ce09ce984db073c66e8e4e
Malware Config
Extracted
-
formbook
-
4.1
-
dz25
-
sdw123.com
-
theflower-jeju.com
-
bigbargins.shop
-
xn--grsdetetizao-dcb9c.site
-
visionprobiz.com
-
ebruunalsigorta.xyz
-
51tree.net
-
tommeynadier.com
-
spx21.com
-
researchupdatehub.com
-
rserveohio.com
-
schemaconsultant.com
-
ec-peleti.com
-
songkokgelhq.shop
-
sixfigureswithkarah.net
-
quickfinancebrokerage.com
-
alliance-couverture.com
-
heartlandinnovates.com
-
art-friday.online
-
curi-o-rama.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21551.10154.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21551.10154.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21551.10154.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21551.10154.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21551.10154.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21551.10154.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21551.10154.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1220-13-0x0000000074B10000-0x00000000751FE000-memory.dmp
memory/1220-3-0x0000000000370000-0x000000000038A000-memory.dmp
memory/1220-2-0x00000000021C0000-0x0000000002200000-memory.dmp
memory/1220-0-0x0000000000B80000-0x0000000000C1A000-memory.dmp
memory/1220-4-0x0000000000350000-0x000000000035C000-memory.dmp
memory/1220-5-0x0000000002150000-0x00000000021C6000-memory.dmp
memory/1220-6-0x0000000074B10000-0x00000000751FE000-memory.dmp
memory/1220-12-0x00000000021C0000-0x0000000002200000-memory.dmp
memory/1220-1-0x0000000074B10000-0x00000000751FE000-memory.dmp
memory/2668-19-0x0000000002700000-0x0000000002740000-memory.dmp
memory/2668-17-0x0000000073950000-0x0000000073EFB000-memory.dmp
memory/2668-20-0x0000000002700000-0x0000000002740000-memory.dmp
memory/2668-21-0x0000000073950000-0x0000000073EFB000-memory.dmp
memory/2668-18-0x0000000073950000-0x0000000073EFB000-memory.dmp
memory/2792-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2792-14-0x0000000000C20000-0x0000000000F23000-memory.dmp
memory/2792-8-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2792-7-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2792-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp