Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
25/04/2024, 01:07
General
- Target 0f4185aed646dcc354f61968b69d25e06fdb3fe3e6bab9b52e2ecce1395f667f.exe
- Size 826KB
- Sample240425-bgn8fscf71
- SHA256 0f4185aed646dcc354f61968b69d25e06fdb3fe3e6bab9b52e2ecce1395f667f
Malware Config
Extracted
-
formbook
-
4.1
-
ij84
-
resetter.xyz
-
simonbelanger.me
-
kwip.xyz
-
7dbb9.baby
-
notion-everyday.com
-
saftiwall.com
-
pulse-gaming.com
-
fafafa1.shop
-
ihaveahole.com
-
sxtzzj.com
-
996688x.xyz
-
komalili.monster
-
haberdashere.store
-
nurselifegng.com
-
kidtryz.com
-
ghvx.xyz
-
1minvideopro.com
-
hidef.group
-
stylishbeststyler.space
-
spx21.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 3 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 45 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f4185aed646dcc354f61968b69d25e06fdb3fe3e6bab9b52e2ecce1395f667f.exe"C:\Users\Admin\AppData\Local\Temp\0f4185aed646dcc354f61968b69d25e06fdb3fe3e6bab9b52e2ecce1395f667f.exe"2⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ghedgegehe.exe"C:\Users\Admin\AppData\Local\Temp\ghedgegehe.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 16 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ghedgegehe.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\order.exe" && ping 127.0.0.1 -n 16 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\order.exe"4⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 165⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 165⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\order.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\order.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
order.exe
memory/1220-36-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1220-37-0x00000000018C0000-0x00000000018D4000-memory.dmp
memory/1220-34-0x00000000019D0000-0x0000000001D1A000-memory.dmp
memory/1220-31-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1516-25-0x0000000005980000-0x0000000005990000-memory.dmp
memory/1516-22-0x0000000000D00000-0x0000000000DD6000-memory.dmp
memory/1516-33-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/1516-30-0x0000000005980000-0x0000000005990000-memory.dmp
memory/1516-29-0x0000000005980000-0x0000000005990000-memory.dmp
memory/1516-28-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/1516-27-0x0000000007CD0000-0x0000000007CD6000-memory.dmp
memory/1516-26-0x0000000007CB0000-0x0000000007CCA000-memory.dmp
memory/1516-24-0x0000000005980000-0x0000000005990000-memory.dmp
memory/1516-23-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/2436-5-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/2436-7-0x0000000006160000-0x000000000616A000-memory.dmp
memory/2436-6-0x0000000005FB0000-0x0000000005FF4000-memory.dmp
memory/2436-0-0x0000000074510000-0x0000000074CC0000-memory.dmp
memory/2436-1-0x00000000003A0000-0x0000000000476000-memory.dmp
memory/2436-13-0x0000000074510000-0x0000000074CC0000-memory.dmp
memory/2436-2-0x0000000004BD0000-0x0000000004C6C000-memory.dmp
memory/2436-3-0x00000000052E0000-0x0000000005884000-memory.dmp
memory/2436-9-0x00000000076E0000-0x0000000007C0C000-memory.dmp
memory/2436-4-0x0000000004D30000-0x0000000004DC2000-memory.dmp
memory/2524-40-0x0000000000A50000-0x0000000000A5C000-memory.dmp
memory/2524-39-0x0000000000A50000-0x0000000000A5C000-memory.dmp
memory/2524-41-0x0000000000830000-0x000000000085F000-memory.dmp
memory/2524-42-0x0000000002780000-0x0000000002ACA000-memory.dmp
memory/2524-43-0x0000000000830000-0x000000000085F000-memory.dmp
memory/2524-45-0x00000000025C0000-0x0000000002653000-memory.dmp
memory/3356-38-0x0000000008B90000-0x0000000008D2F000-memory.dmp
memory/3356-46-0x0000000008B90000-0x0000000008D2F000-memory.dmp
memory/3356-49-0x0000000002FD0000-0x00000000030F6000-memory.dmp
memory/4576-10-0x0000000074510000-0x0000000074CC0000-memory.dmp
memory/4576-12-0x00000000050C0000-0x00000000050D0000-memory.dmp
memory/4576-14-0x00000000050C0000-0x00000000050D0000-memory.dmp
memory/4576-16-0x0000000074510000-0x0000000074CC0000-memory.dmp